Gabe Newell Responds: Yes, We're Looking For Cheaters Via DNS

dotarray writes "Valve has stepped up to answer allegations that the company's anti-cheat system was scanning users' internet history. Rather than a simple, sanitized press release or a refusal to comment on 'rumours and innuendo,' Valve CEO and gaming hero Gabe Newell has personally responded." Newell or not, not everyone will like the answer. The short version is that Yes, Valve is scanning DNS caches, with a two-tiered approach intended to find cheating users by looking for cheat servers in their histories. Says Newell: "Less than a tenth of one percent of clients triggered this second check, accessing the DNS cache. 570 cheaters are being banned due to DNS searches."

Comments

Still abusive

[i kan reed]

Sorry Gabe, you're not allowed to see my DNS history. You aren't allowed to see GabeNewellNatiliePortmanHotGritsFanFiciton.net in my history. That's not allowed.

Re:Still abusive

[PhrostyMcByte]

The app is comparing DNS records with a client-side database of cheat sites, and if it finds a match sending it to Valve's servers for verification & ban-hammer. It's not sending every site you visit, unless the only sites you visit were via DNS records used by cheat developers.

Re:Still abusive

[Anonymous Coward]

Part of my job involves me going to these kind of sites and seeing what's happening. Visiting does not imply guilt, and, in fact, I am not cheating at any games. Not that I even own multiplayer Steam games, but that just furthers my point. Why should I be considered at risk of being banned when I am not cheating?

Re:Still abusive

[Andy Dodd]

So what if someone puts a URL for a cheat site in a forum comment somewhere, disguised as something else?

Re:Still abusive

[ebrandsberg]

did you even read his response? They look for indications that the cheat is in play, THEN they check DNS as verification, and send a HASH of the dns name to their servers for comparison. This means they don't even see the actual dns name on their side, they can just check against known hashes of the sites the DRM used for verification. That is why it is two staged. Simple existence of the names in your DNS cache won't trigger the ban hammer.

Re:Still abusive

[Zembar]

He specifically says that it doesn't care about what web sites you are visiting, it's the adresses to the cheat DRM servers it looks for, to detect if a cheat has dialed home from that computer. It only checked this if the account was already suspected of using the cheat.

So, in an impressive turn of events, many cheats now include DRM and anti-cheat codes. These phone home to a DRM server that confirms whether or not a cheater has paid to use that particular cheat

Also, he says that since the cheats invented countermeasures to this in just 13 days, they already stopped doing it. The summary is quite misleading. (Not necessarily a big surprise on slashdot...)

Re:Still abusive

[Anonymous Coward]

Not only did you fail to RTFA, you failed to read the fucking comment you replied to. Please stop posting.

Re:Still abusive

[Bob9113]

The app is comparing DNS records with a client-side database of cheat sites, and if it finds a match sending it to Valve's servers for verification & ban-hammer. It's not sending every site you visit, unless the only sites you visit were via DNS records used by cheat developers.

Compare: We record images using your laptop's webcam, but we only look at them if our software algorithm thinks the images show you doing something that violates our ToS.

Re:Still abusive

[Cley Faye]

If you manually visit the domain used internally by cheats for DRM checking, it's beyond curiosity.

Re:Still abusive

[wagnerrp]

It's more like an anti-theft service that when it thinks the laptop may have been stolen, it then turns on the camera to see who is using the laptop. Access to the DNS cache is only triggered by some other first-tier behavior.

Re:Still abusive

[QuietLagoon]

did you even read his response? They look for indications that the cheat is in play, THEN they check DNS as verification...

Explaining something does not justify it. They should not go rummaging through my computer. Period.

Re:Still abusive

[Anubis IV]

So you can't be good at video game and curious about technologies at the same time?

You can be, actually. As Gabe pointed out, the cheats these days have DRM installed to ensure that users of the cheat are actually paying for it. VAC, if it detects indications of the cheat, checks to see if the DRM's phone-home servers are in your DNS record, then sends back hashes of those servers for verification in Valve's system. It was made pretty clear that merely visiting the site for a cheat to check it out, whether intentional or accidental, would not result in getting flagged for the DNS check, let alone getting banned. Even purchasing the cheat would not get you banned, in and of itself.

Basically, the DNS check only kicks in after you've purchased a cheat and used it in a game, at which point you've crossed the line from mere curiosity into abuse, and even then, they weren't banning people immediately, but rather doing the DNS check for final confirmation of cheating activity. And even then, it's only looking for the phone-home servers, not the web servers, used for those cheats, so people who were merely good players and had looked at the servers for the cheat without ever installing and running it would be perfectly fine.

So...what's your gripe then?

Re:Still abusive

[wagnerrp]

I don't care what it is sending or not sending to Valve. It's still an unnecessary invasion of privacy. In fact, its so easy to circumvent that I have a hard time believing that he is even being honest about why they are looking at the DNS records to begin with. How hard is it to clear my history, browse in Incognito mode, or do all of my cheating on a separate machine or in a VM? Trivial.

It's not your web browser accessing cheat websites, it's your cheat software itself accessing its servers. Clearing your history or browsing in Incognito mode won't do anything. You cannot use a VM, since the cheat software must be run on the same machine as you are running the game (and VAC).

And in fact, it may incorrectly flag me as a potential cheater anyway. I have looked up exploit information for games. I did not look in order to cheat at the game, but because I kept running into people who were not being busted for cheating and I wanted to know how they were exploiting the game. I was looking for a better way to tell when someone was cheating, not to actually cheat myself.

Then it will not flag you as a potential cheater, since you were not running the cheat software to access the DNS entries in question. Further, it would never flag you as a potential anyway. This mechanism is only triggered after some other behavior has already flagged you as a potential cheater. This is a confirmation mechanism.

While the basic idea of a piece of software accessing and reporting this information, at least in Valve's public explanation of what they were doing, it was entirely in good faith.

Re:Still abusive

[AC-x]

Don't worry, all the DNS names were MD5 hashed, so Gabe will only know you visited b80747491a0922eeaf0d800983ddc886 :)

Re:Still abusive

[Krojack]

I once wrote a fishing bot for World of Warcraft. I was curious how it worked and if I, myself, could make one. I was successful. Afterwords I never used it again.

It's my way of learning little things on my off time when I'm bored. It's better than watching reality TV afterall.

Re:Still abusive

[mrchaotica]

So what? It's still a violation of my privacy and therefore unethical.

Re:Still abusive

[The MAZZTer]

Fortunately, the DNS cache is only checked if VAC detects you USING a cheat. Furthermore, you can visit cheat sites all day, VAC doesn't care. What it does care about are whether your PC is talking to DRM auth servers used by some cheats... only the cheats are going to be connecting to those servers.

Re:Still abusive

[Krojack]

I agree with you 100% however I'm guessing somewhere in the super duper fine print that you agree to when installing Steam, you give them permission to do this. If it's not there it will be within the next week.

Re:Still abusive

[toopok4k3]

Uninstall steam then. You have that option.

Re:Still abusive

[Wovel]

It's not your browser cache...

Re:Still abusive

[Ronin Developer]

I am not a gamer so I don't know if this is permitted by their TOS.

However, I don't care if they are sending a hash or the actual DNS inquiry. If they have a matching hash on their end, they are simply translating one entry into another form and back again. How do we know the limit of hashes for sites they have accumulated outside of known cheat sites?

If their TOS permits it, well, then buyer beware. But, I remember how everyone kicked and screamed when Apple and Microsoft did similar things.

They ARE examining your personal DNS history cache and sending, supposedly, matching entries. That is spyware - pure, simple and evil.

Re:Still abusive

[jader3rd]

Sorry Gabe, you're not allowed to see my DNS history.

So what OS model can we use to isolate one program from another? Do we want that kind of model?

Re:Still abusive

[jader3rd]

They should not go rummaging through my computer. Period.

Then prevent them. Use an OS that prevents on application from rummaging through your computer.

Re:Still abusive

[toopok4k3]

Yes, so what?

Re:Still abusive

[Bob9113]

It's more like an anti-theft service that when it thinks the laptop may have been stolen, it then turns on the camera to see who is using the laptop.

That would be me choosing to enlist my private sensors in a service that is specific to the use of those sensors. Two significant differences in this case: In the narrow sense, the user has not given informed consent to the use of his private sensors. In the broader sense, our society has not had a frank discussion about requiring access to a person's private sensors as a condition of the sale of an urelated product.

Re:Still abusive

[ebrandsberg]

If you think looking at DNS is abusive, you probably don't want to know what it takes to find installed rootkit based cheats or similar. The fact that they are only sending hashes of the names found, in my mind, makes this a reasonable approach as a 2nd pass to verify that they don't have false positives. From the way I read this, the idea is to do a 2nd check just to verify that the first check didn't flag you incorrectly.

Re:Still abusive

[CrankyFool]

This isn't quite the same as that old "well, just don't use it" canard.

Valve was engaging in a set of behaviors which you considered acceptable, and so "purchased" (more on why "purchased" is in quotes in a second) some games from them.

They've changed their behavior. Let's say you don't want to do business with them anymore. You could, of course, stop using Steam ... and lose access to all your games, which you probably thought you "purchased" in some sort of "I can use it for the rest of my life" sense, but actually just got a license to use for as long as they feel like it. This is different from a "service" where the expectation is that the benefit you're getting from them is recurring on some sort of cycle.

Someone will, doubtlessly, point out that you can put the Steam client into offline mode. To which I'll say that you can't do it indefinitely. To which they'll say "but Valve says you should be able to do that," to which I'll point to http://www.pcgamer.com/2013/11... which basically says "Valve says they want to make offline mode work 'forever', but they're not there yet."

It doesn't really matter, IMHO, that the scope of what they did here was relatively minor. The issue is that Valve, much like Sony, feels like they can trawl through your computer in areas that have nothing to do with playing the game. Today it was minor because it makes sense to start small; but if they feel comfortable trawling your DNS history -- and Newell clearly says that he has no problem with this practice -- what else do they feel comfortable doing?

Re:Still abusive

[AnttiV]

That's all fine and well and I don't have any problems with that... provided that system is ONLY activated for multi-player games. If I - or anyone else - wants to cheat in a single-player game (even if the game itself has multi-player, but the cheating happens in a single-player campaign) that's my - or their - own business and nobody SHOULD be able to prevent anyone from doing that, let alone BAN based on that.

I hate, hate, HATE cheating in multi-player games. I don't usually do it in a single-player game either, but there have been occasions when I've played a particular game n+1 times through and I just want to have some fun and see what is possible with cheats. This SHOULD BE allowed in all instances, as it does NOT, in any way, shape or form harm - or indeed affect - anyone else's gameplay.

I sincerely hope that system does not flag anyone based on cheats used while playing single-player. At MOST what a system like that should do, is disable on-line functionality while the cheat is in use. Nothing else. At LEAST not BAN anyone based on that, that just insane.

Re:Still abusive

[vux984]

I am not the person you are responding to, but for my part:

At this stage I have no real gripe at all and would have opted into this without hesitation, had it been disclosed. (I also understand that disclosing it mitigates its effectiveness as the cheat makers will now all switch to ip based lookups, or rotating dns names etc to make detection more difficult, however, as this cat and mouse game between valve and cheaters is being waged on MY computer I still feel I should have some idea what is going on.)

That said, I do find it... somewhat disturbing that they took the liberty they did. The fact that they didn't abuse it still raises the issue that they could have.

When the next shoe drops will it be revealed that some anti-cheat / anti-virus / anti-malware software is quietly reading my bank statements when I view them online automatically for evidence of cheating / infection / whatever.

And it raises the point yet again just how little we collectively realize what applications are doing with data on our system, how desperately we need to figure out how to mainstream sandboxing / selinux type permissions / application partitioning etc in a way that makes it both easy and reliable, and how much information even the host operating system leaks about us to other applications.

Re:Still abusive

[squiggleslash]

Nothing. Unless you're actually doing things on an online game that would make the admins think you were cheating, you won't be victimized simply because you follow a link.

And bear in mind that they're not looking for public website domain names unless by sheer coincidence (or cheaping out on the part of the cheats vendor - yes, that's what we're talking about) the same server AND domain name is being used for both the vendor's website and for the DRM checking code in their cheat patch.

I don't think it'd make any sense for Valve to get upset about people visiting websites discussing cheats. Too many innocent hits, and besides, many websites with information like "Install this DLL for infinite lives" are also going to come up with stuff like "You get past the Hamster of Doom by picking up the Golden Sunflower Seed under the third rock, throw the seed at the hamster, and then jump, dart left, dart right, and hop over the Hamster as he swipes at you."

Everyone reading the story seems to think they're blocking the latter. They're not. They're looking for people using commercial cheats, and looking for evidence (in this case, in the DNS cache) that the commercial cheat is installed by looking at DNS lookups that would be performed by the commercial cheat itself.

Re:Still abusive

[Lumpy]

So just run a script to purge the DNS cache every 10 minutes. Solves the problem.

Re:Still abusive

[Anubis IV]

And it raises the point yet again just how little we collectively realize what applications are doing with data on our system, how desperately we need to figure out how to mainstream sandboxing / selinux type permissions / application partitioning etc in a way that makes it both easy and reliable, and how much information even the host operating system leaks about us to other applications.

I think this is what it really boils down to. They've always been able to abuse it. The fact that they didn't when they had the chance is a good indication that they're not planning to do so, but that doesn't mean that others aren't currently abusing it. Most of the outrage here seems to be directed at Valve because they reminded us of just how vulnerable our data actually is, even if they themselves didn't abuse it.

We can use more reminders like that, though, as you said, I'd prefer that I knew about them in advance.

Re:Still abusive

[Anubis IV]

Completely agree, and I have no idea what VAC is doing in this particular case.

Re:Still abusive

[ShakaUVM]

>Explaining something does not justify it. They should not go rummaging through my computer. Period.

Do you understand how VAC and similar anti-cheat software looks? It will scan through your memory looking for certain DLLs loaded, look through your computer files for cheats, and so forth.

Other than you being ignorant of what is actually happening before, I don't see anything that has changed with this announcement.

It's not like they're recording all of your metadata, uploading all your facebook posts to a data center in Utah, and targeting people for drone strikes using cell phone records.

Re:Still abusive

[SlippyToad]

Have you been banned, or are you just being a concern-troll asshole, and whining about something you don't actually understand.

Re:Still abusive

[Baloroth]

That's all fine and well and I don't have any problems with that... provided that system is ONLY activated for multi-player games. If I - or anyone else - wants to cheat in a single-player game (even if the game itself has multi-player, but the cheating happens in a single-player campaign) that's my - or their - own business and nobody SHOULD be able to prevent anyone from doing that, let alone BAN based on that.

VAC is only activated in multiplayer games that support it, and usually only on VAC-enabled servers (in fact, you can find servers for many of those games that explicitly permit cheats). Some games only support VAC servers (specifically, some of the CODs), but those are exceptions.

Re:Still abusive

[SlippyToad]

Then don't play the fucking game.

Re:Still abusive

[Baloroth]

Then don't connect to VAC enabled servers. It's that simple. If you connect to a VAC enabled server, you are implicitly giving Valve permission to rummage around in your computer for cheats, because that is how anti-cheat software works (all anti-cheat software. That's how they work: scanning the memory, running programs, etc.) It's quite simple, really: if you want to connect to someone else's server, and that person requires you to use VAC, then you use VAC or you don't connect.

Except for some of the CODs, you don't even have to connect to a VAC server to play multiplayer anyways.

Re:Still abusive

[Minupla]

OK, I'm going to rant a bit here, and it's not specifically directed at the parent comment.

Hashs are NOT a form of magic pixie dust you spread on information to make them magiclly private.

Consider:
You enter your SSN, the app hashes it and then sends it to me to compare against a hashed list of SSNs from some other source. I never get your unhashed SSN.

Are you safe?

No. There is NOTHING preventing me from hashing every possible SSN and comparing them. the total number of possible SSNs (ignoring for the moment that I can narrow the attack space significantly by ruling out SSNs that have not been issued yet) is not computationally prohibitive to search, even salted.

OK, now bringing us back to the case in point.

Does hashing the DNS address provide you any useful privacy preservation benefit?

Well Valve has already said that they have a list of DNS addresses they're searching for. Ergo, they have hashed that list ot compare against your DNS. How hard would it be to hash the $(sites viewed as evil by your cultural/legal framework) and compare it to your hashed DNS list. Trivial.

Do you feel like your privacy is preserved?

Min

Re:Still abusive

[higuita]

No, he can still play... just don't cheat!!
This way his DNS history will be totally safe

Re:Still abusive

[Baloroth]

And, if I'm using my cheat in a game I only play in single player?

Then, unless you have deliberately activated VAC on your private server while running the cheat (in which case, you're a moron), VAC won't do anything at all whatsoever, because VAC only turns on when you connect to a VAC enabled server in a multiplayer game..

Re:Still abusive

[Em Adespoton]

If you think looking at DNS is abusive, you probably don't want to know what it takes to find installed rootkit based cheats or similar. The fact that they are only sending hashes of the names found, in my mind, makes this a reasonable approach as a 2nd pass to verify that they don't have false positives. From the way I read this, the idea is to do a 2nd check just to verify that the first check didn't flag you incorrectly.

So are you saying that if I go through your mail and send the contents of anything that looks sketchy to someone, that's bad... but if I translate the contents into a different language before I send them, that's OK?

A hash is just a shortened form of the same thing. If a hash is being sent, Valve knows the site was in your DNS cache.

What they SHOULD be doing is downloading their hash list to YOUR computer, comparing THEIR list against your cache, and setting a flag if there's a match. Then, if the suspected cheat algorithm is triggered, it can check that flag (which is, of course, signed with a public key) to see its value.

This way, they've got their "possible cheat sign" without sending details back to their servers where they can track.

You see, when they're sending hashes back, they're collecting a history on each user that they can then store for as long as they feel like. They know which suspect site you've visited (after all, THEY hashed the domain in the first place; they know what it is), and the system can be easily abused.

Of course, if it's done locally, then all it takes is a quick hack to get around the detection system, and they're no further ahead. But now that the system is known, all people have to do is flush their DNS cache prior to playing and THIS system is stymied too.

Re:Still abusive

[Baloroth]

That would be me choosing to enlist my private sensors in a service that is specific to the use of those sensors.

Except in the case of VAC you did choose to enlist the use of VAC to prevent cheats, specifically, when you connected to a VAC enabled multiplayer server. VAC isn't some generic thing Valve sticks on all Steam games, you know: it's only enabled when you connect to a server that is VAC enabled (which is in every game I've player very clearly marked as such). You don't want VAC poking around on your computer? Don't play on a VAC server.

Re:Still abusive

[acariquara]

That's all fine and well and I don't have any problems with that... provided that system is ONLY activated for multi-player games.

...You just described VAC, buddy. It's only active for a few multiplayer games, IF you connect to a VAC-enabled server. There are even multiplayer game servers that encourage cheating.

Re:Still abusive

[dmomo]

Why? Give me those domains.. I want to go ahead and manually visit them. I'm curious. And I don't even use Steam.

Re:Still abusive

[gnick]

Use an OS that prevents on application from rummaging through your computer.

It seems reasonable to you to change your OS in order to play a Windows-based game (and everything else you've purchased that runs on Windows) in a VM environment and set up all the appropriate proxies, etc., for all of your software? Methinks you're not a typical gamer... And have a lot of time on your hands.

Problem: "I think it's unreasonable for police to enter my house and randomly search everything."
Solution: "Then prevent them. Move your family to Mexico and you can all just fly back and forth every day to prevent them from rummaging through your house."

Yeah - It's just that easy.

Re:Still abusive

[Splab]

Then you probably should stop playing games - pretty much all online games with a bit of weight behind them have some form of active anti cheat software running. They will not only be scanning your files, but also actively checking memory for mischievous software.

And that was years ago when I was playing - I can't imagine their scanners are less intrusive these days...

Re:Still abusive

[jandrese]

Explaining something does not justify it. They should not go rummaging through my computer. Period.

You do understand what Valve Anti-Cheat is trying to do right? By definition it has to go rummaging through your computer to find third party cheat applications. If you don't like this, then you need to play games that don't have anti-cheating measures in place. They're a little hard to find though, because those games online communities tend to be destroyed by the cheaters.

Re:Still abusive

[Sowelu]

Sounds good. It's nice that Free games are out there. However, after playing games that don't try to detect this stuff, I'm very happy to not only give VAC permission to check my stuff but also PAY for the privilege of playing against other people who do the same thing. I guess it's kind of like going to a restaurant with a dress code... sure, maybe it "infringes" on your "rights" to wear whatever you want, but there's people who choose to pay to be in a space where everyone follows the same restrictions. It gives a certain atmosphere. But hey, go ahead and cook bacon at home in your underpants, I'm not doing anything to stop you.

Re:Still abusive

[Anubis IV]

Not really. Valve only had the DNS check in place for 13 days, and it was only aimed at a specific set of cheats that were not engaged in the behavior you're describing. Once the cheat creators caught on, they simply modified the DNS records, rendering the DNS check worthless. Besides which, it's in their best interests to do it that way, since the last thing they'd want to do is give the impression that you could get banned for even checking out their site.

Re:Still abusive

[Lothsahn]

I think this was a bug. I too, experienced this behavior in the past, but on my recent travels, even when I've forgotten to put it in offline mode, I was able to play with it starting in offline mode.

While that bug was annoying, I believe it's been resolved, and you won't find this is a problem anymore. I haven't found it to be in the last 2 months.

Re:Still abusive

[Beerdood]

Most single player games on valve, or single player versions have achievements (at least 100% of the games I've purchased, around 30 or so). If you're using a cheat on single player and you're able to get those achievements as a result, then they've been devalued. I suppose they could start disabling achievements if a hack is detected, but what would be the benefit to them for implementing such a system? Then it's a constant game of cat and mouse with detectable hacks and cheats in the game.

Maybe you and others don't care about achievements or think them silly or stupid, but plenty of gamers get some sense of accomplishment or satisfaction when they're completed - especially the harder ones. We don't want these tarnished by people with hacks and cheats.

Re:Still abusive

[Anubis IV]

Yours is a perfectly valid complaint that I wouldn't disagree with in the least. That said, suggesting that it in any way contradicts my comment would be a case of moving the goal posts, since I never stated that there weren't any valid gripes. I merely pointed out that the previous commenter hadn't voiced one.

Re:Still abusive

[Rakarra]

So are you saying that if I go through your mail and send the contents of anything that looks sketchy to someone, that's bad... but if I translate the contents into a different language before I send them, that's OK?

Oh, if the FBI had evidence that you'd, say, been sending letters to terrorist cells, then yes, I think it would be totally reasonable for them to go through your mail. If they had no such suspicion, no, that wouldn't be reasonable. That's the analogy that (somewhat works).

What they SHOULD be doing is downloading their hash list to YOUR computer, comparing THEIR list against your cache, and setting a flag if there's a match.

As every game company knows, the server should not expose any information to the client that you don't want the user to know, whether the software will tell them or not. Valve likely does not want the list of websites to get out, as not finding your favorite website in the banned list means you can view it with impunity. I wouldn't trust the public key security (all they have to do is mess it up), so why should they bother when they can run the checks server-side instead?

Of course, if it's done locally, then all it takes is a quick hack to get around the detection system, and they're no further ahead. But now that the system is known, all people have to do is flush their DNS cache prior to playing and THIS system is stymied too.

That's true, the system will only catch the unwary cheater.

Re:Still abusive

[vakuona]

You are using their service. You agree to their terms. Don't like it, don't use their service.

They are only looking out for their honest customers who would otherwise be affected by the cheating that would go on, and who may then decide to leave and not return.

Re:Still abusive

[Rakarra]

So just run a script to purge the DNS cache every 10 minutes. Solves the problem.

I think the problem is that the cheat has to be online-connected to a cheat server, so it may randomly repopulate the DNS cache.

Re:Still abusive

[dougisfunny]

Then VAC won't be running.

Re:Still abusive

[squiggleslash]

You want to visit a bunch of servers that run nothing but web services, if they run a web server at all?

Because that's the type of server we're talking about here. Something cheat.dll uses to phone home, connecting to port 1234 on drm-server-73.cheatcorp.com. Not www.cheapcheats.com where you bought the cheat from.

Re:Still abusive

[hypergreatthing]

Usually this is done with the authorization of one who has his laptop stolen.
When it's done without knowledge of the owner, it's called hacking or fraud.

Re:Still abusive

[ArsonSmith]

Great point, when it's a company like Valve, just take your business elsewhere. It's quite simple. But when it's government the restrictions on what they can do should be great and well enforced.

Re:Still abusive

[rudy_wayne]

This whole thing started when somebody posted a screenshot of some disassembled code, which showed, among other things, that the software is using undocumented functions to enumerate all the cached entries.

So Valve spent X number of man hours developing this anti-cheating module, plus XX more hours figuring out undocumented functions that they need to accomplish this, and then, THEY ABANDONED THE WHOLE THING AFTER 13 DAYS because people figured out a way around it..

I understand that Valve want to stop cheating and that's OK. But, seriously, did nobody at Valve just think for a minute and say "before we spend a lot of time developing this, how easy will it be for the cheaters to circumvent?"

Re:Still abusive

[Cley Faye]

Well then if you do this for valve games, you just don't do it on VAC-enabled servers...
A good question would be "is VAC running all the time, or only on a VAC-enabled game"...

Re:Still abusive

[lgw]

I've had more entertainment with some MMOs writing bots than playing the actual game. I wrote a bot for Everquest 2 crafting that was great fun to write and tune (there was actually some game strategy to that goofy crafting system, so there was a neat optimization puzzle there). But you should anticipate the ban hammer when you do stuff like this - don't have any linkage between the meta-game and any game account you actually care about.

Re:Still abusive

[wagnerrp]

It was done with authorization. You authorized it when you agreed to the terms of use of a VAC-protected game, playing on VAC-protected servers.

The trouble with this is the same as trouble with things like IDS, it only works through obscurity. As an IDS protects against an attacker, anti-cheat protects against you, and the only way it is going to work is if you don't know what it is doing. If you knew how it operated, you could alter your actions to bypass its detection mechanisms, as has supposedly happened now that the behavior has become public.

Re:Still abusive

[DrGamez]

This is incorrect on a few levels.

1. This isn't beyond curiosity. Just because I read about Hitler and the Holocaust doesn't mean I have more than a passing morbid curiosity in the history.

2. You can be really good AND visit these sites all day. Unless VAC trips on you (and being "really good" never gets you caught, they look for specific actual hacks and vectors, not just some K:D ratio), it will never check your DNS.

3. The DNS entry it's looking for isn't "www.hacks.com", it's looking for the call-home function of the hack itself; because hackers don't pay (imagine that) the hacks themselves need DRM.

You have to be caught by VAC (using a hack) and then you need to have a current call-home function to a known hacking service/program to get tripped up by this. That's why it "only" caught ~500 users, this isn't some massive dragnet to ban anyone who's googled the words "counter strike hack".

Re:Still abusive

[DrGamez]

Most, if not all, anti-cheat programs do this.

I know this is a big issue for some, but clearly you have not done your due-diligence when it comes to knowing what services you allow to run on your machines.

Re:Still abusive

[DrGamez]

It means you still haven't read the article.
(Sorry, that's rude, but seriously go have a read, you're 100% safe to visit all the terrible hacking website you want. Just don't use the hacks they sell.)

Re:Still abusive

[DrGamez]

But he won't. :)

Re: Still abusive

[LocalH]

You didn't actually read what they did. Or the fact that they're not doing it anymore because it lost it's usefulness.

Re:Still abusive

[sosume]

That means, if Johnny Random wants to be able to play the game in a certain way (getting achievements), that I cannot play the game in the way that I want to. Only the way the game developers intend to.

Re:Still abusive

[sosume]

It would be much easier to replace your ipconfig executable (or disallow access to it from steam)

Re:Still abusive

[poetmatt]

It's also perhaps not great that this is the method they are tracking cheats, because using a VPN or proxy will likely thwart some of the positives they would be looking for here. So the method of tracking was via obscurity, which is now gone.

Re:Still abusive

[sosume]

I am a consumer. I have lots of rights or Steam wouldn't be allowed to take my money. I don't care about their terms when they are illegal. If they think they can take drastic measures they'd better be well prepared for consumer watchdog hell to be unleashed. Especially for a service which is rumored to bring in over a billion dollar in yearly revenue.

Re:Still abusive

[BattleApple]

I like achievements, but I do wish I could bypass some of them. Not because they're difficult, but because they require you to do things like play a game with a certain number of friends. I neither have nor want any friends (online or in the real world)

Re:Still abusive

[sosume]

I'm sure you can somehow change your DNS cache to flush immediately.
Run a local DNS server on the same machine for extra points. I bet the cheat authors will respond by implementing their own DNS lookup.

Re:Still abusive

[cbhacking]

And what if I don't "manually" visit it, but instead somebody posts an image to some forum I read, and the image source is the domain in question? It doesn't even matter that there's no web server running there; my browser will still attempt the lookup (*it* doesn't know there's nothing listening on 80) and therefore my DNS resolver will still cache the result. Boom, I am a "confirmed" cheater, despite never having used the tool in question at all.

Re:Still abusive

[Cley Faye]

Uhh, you're contradicting yourself on point 2 and 3: the domain we're talking about didn't host anything to "visit".

Re:Still abusive

[Cley Faye]

No, you have one flag. This is not a "DNS entry present == cheater" system; it just acted as a confirmation when the hack itself was detected. Don't use boom as a shortcut.

Re:Still abusive

[rjstanford]

I like achievements, but I do wish I could bypass some of them. Not because they're difficult, but because they require you to do things like play a game with a certain number of friends. I neither have nor want any friends (online or in the real world)

So don't get those achievements. Simple. Once you cheat to get a single one, what's the value in the remaining ones?

Re:Still abusive

[Ash Vince]

I am not a gamer so I don't know if this is permitted by their TOS.

However, I don't care if they are sending a hash or the actual DNS inquiry. If they have a matching hash on their end, they are simply translating one entry into another form and back again. How do we know the limit of hashes for sites they have accumulated outside of known cheat sites?

If their TOS permits it, well, then buyer beware. But, I remember how everyone kicked and screamed when Apple and Microsoft did similar things.

They ARE examining your personal DNS history cache and sending, supposedly, matching entries. That is spyware - pure, simple and evil.

If you are not a gamer then why bother contributing to a discussion that specifically deals with online gaming?

The truth is that to make a successful online game now you need to do something about cheats. They ruin the game for everyone.

The two main anticheat products I know of are VAC and Punkbuster and both are pretty invasive. They need to be.

The moron who noticed this behaviour then posted it on hacking forum so you can be fairly sure he was a cheating scumbag trying to find out how he got caught. We don't know how many innocent people have this happening if any.

Re:Still abusive

[rahvin112]

This isn't the government. It's a private service with terms that you must obey. If you don't like it don't use it.

Given that there are apparently companies or individuals clearly breaching the steam and valve TOS for money I just have to question why valve doesn't go after these people/groups in court. If they are in a western country you could fairly easily eviscerate them and take all the profits and likely get them in serious trouble. Even if they are outside the west they should be able to use the court to effectively freeze all money conduits which will remove the profit incentive. Without the profit incentive I dare say the ability for the cheat to develop rapid countermeasures would go away. Oh there is still going to be people that develop the cheats for fun but I dare say they wouldn't share the cheats because they run the risk of being banned as a result.

This is one area where I actually agree that court action should be used, cheats in multiplayer can do severe damage to a game and the companies should aggressively go after people/companies developing these cheats. Honestly if the cheats have progressed to the point where people are paying for it and the cheat itself is running DRM then the people involved should be easy to target.

Re:Still abusive

[arth1]

You see, when they're sending hashes back, they're collecting a history on each user that they can then store for as long as they feel like. They know which suspect site you've visited (after all, THEY hashed the domain in the first place; they know what it is), and the system can be easily abused.

It probably already is.
How much would you bet that there isn't a copy of the DNS history going to a three letter agency, and Steam not being allowed to disclose this?

Re:Still abusive

[BattleApple]

If I get 99 out of 100 achievements, it's not like I'd feel guilty for cheating on the last one if it's something I would never complete otherwise. I just like to see them all completed. And maybe something happens when they're all complete. As for multiplayer, I'm very much against cheating if it affects other players.

Re:Still abusive

[Em Adespoton]

What they SHOULD be doing is downloading their hash list to YOUR computer, comparing THEIR list against your cache, and setting a flag if there's a match.

This is what they are claiming to do. The particular hash and details of the first cheat check that lead to the DNS check only get sent back after they did a comparison to known cheat DRM services.

No; they shouldn't be sending back the hash -- a "hash" of a domain is equivalent to the domain itself; there's nothing being hidden. They should send back the result of the hash comparison if there's a match.

Re: Still abusive

[Em Adespoton]

So why should they care about your rights when you are violating theirs?

Visiting a website isn't violating their rights.

However, unless the trigger that causes the lookup is an FP, they are within their rights to terminate the contract.

So the issue here is that they're exfiltrating data, not that they're checking the site and terminating the contract.

As a comparison, if I were doing drugs, that doesn't give the police the right to bust down my door to search for drugs. A warrant based on suspicious activity gives them that right. This is equivalent to "that guy looks shady, lets search his place and see if there are indications he has visited those shady places". Police need a warrant for that. Valve is not the police, so this could get them prosecuted under the same hacking laws that would apply to you or me searching someone's computer without authorization.

Re:Still abusive

[Em Adespoton]

So are you saying that if I go through your mail and send the contents of anything that looks sketchy to someone, that's bad... but if I translate the contents into a different language before I send them, that's OK?

Oh, if the FBI had evidence that you'd, say, been sending letters to terrorist cells, then yes, I think it would be totally reasonable for them to go through your mail. If they had no such suspicion, no, that wouldn't be reasonable. That's the analogy that (somewhat works).

That comment wasn't about whether going through the mail was reasonable, it was about whether translating the mail before sending it back somehow changed its legality or "OK"ness. There's nothing magic about a hash.

Re:Still abusive

[Em Adespoton]

In this case, I doubt it -- the TLA can et the DNS history directly from your ISP. Unless the TLA was targeting a specific set of Steam users, it wouldn't give them anything useful.

Now if it hashed and uploaded your entire DNS history....

Re:Still abusive

[gIobaljustin]

The fact that they didn't when they had the chance is a good indication that they're not planning to do so

That logic is utterly preposterous.

Re:Still abusive

[gIobaljustin]

X is worse than Y, so Y isn't bad. Great logic.

Re:Still abusive

[nblender]

So are you saying that if I go through your mail and send the contents of anything that looks sketchy to someone, that's bad... but if I translate the contents into a different language before I send them, that's OK?

A hash is just a shortened form of the same thing.

Here, I just translated your inbox into MD5 for you. But you can get it back anytime: 22fc90d5d9d1daece424aafaec7698c8

Re:Still abusive

[batkiwi]

You can still play your games without using VAC.

You can still play your games ONLINE without using VAC.

You simply cannot play on VAC enabled servers (run by the community, not by valve) without using VAC.

Re:Still abusive

[CrankyFool]

This significantly changes the situation, I think, and makes it much more palatable -- you either opt in to the protections of VAC (and its attendant privacy breaches) or you opt out, but you can still play. I can live with that.

(I feel like I'm violating some sort of implicit slashdot rule by not flaming you for disagreeing with me; apologies).

-roy

Re:Still abusive

[X0563511]

How long do you think it will take for these cheating applications to implement their own DNS client code?

From the countermeasures perspective, you couldn't possibly ding someone for connecting to, say. 8.8.8.8:53.

Re:Still abusive

[arth1]

In this case, I doubt it -- the TLA can et the DNS history directly from your ISP.

Sure they can, - if you and your ISP are in the US.
But even so, it means they would have to target you and the ISP first. And unfortunately, it looks like our finest no longer bother to only collect data on suspects, with reasonable suspicion as justification, but instead cast nets and see what they can drag up.

So when they see that aa.darko.de hosted an islamist FPS, they hash aa.darko.de and get 98af902dda8088d7204251fe2ff6d7fc, and then search the collected Steam DNS logs for this DNS hash. Those that match are then further targeted.

A couple of years ago, one would think this to be far fetched. After what's been disclosed since then, I think we should expect things like this to happen.
All in the name of public safety, of course. Don't you feel better already?

Re:Still abusive

[Twanfox]

If the 'found' DNS entry is not something that they were looking for, when the client hashes it and sends it to the Valve servers, it would be difficult to translate back into a DNS name. If Valve knows the hash of the specific DNS names they want to know about and your client sends them that then yes, they know. However, given a hash and the wealth of DNS names in the wild, it would be difficult to identify the specific DNS name using just that hash value. That is, after all, one of the primary points of using hash values in the first place.

If they chose to hash every DNS name ever and build a hash table of that, they MIGHT be able to know what sites you visit, but hash collisions and the sheer size of the input set make it difficult to obtain any useful information.

Personally, I'm on the fence whether what they're doing is abusive or not. However, it does appear as though they are trying to take steps to protect user privacy.

Re:Still abusive

[Frobnicator]

It is actually pretty funny from a distant and abstract view.

When most companies dig through your machine, evaluate records and browser caches, and otherwise dig through the garbage that is sure to exist, most people start screaming about privacy rights, corporations and governments intruding in personal lives, and the huge potential for abuse. Assertions that it is only to catch the bad actors are usually dismissed by the crowd.

Valve does exactly the same thing, searches through your machine, digs through all the garbage, and has the potential to collect quite a lot of incriminating details. Assertions that it is only to catch the bad actors are followed by ... mostly acceptance.

0.000876% -- the 570 bad actors that scanning 65 million Valve user accounts has identified.
0.0142% -- the "around 1,000,000 Terrorist Watch List names in March 2009" relative to the number of people the NSA spies on.

So... I guess that means Valve is spying on 65 million people with even less effectiveness than the NSA spying? Or maybe this make it less bad somehow because Steam is voluntary? Maybe we can vote with our wallet! That means go back in time over the past decade, choose someone else to buy the games from, locking us to their platform instead, and... wait...

Re:Still abusive

[Anubis IV]

That logic is utterly preposterous.

Only if you don't believe that we can trust others. If you believe it's possible to establish trust by being consistent in how one deals with sensitive matters, then it's not preposterous in the least. The fact that they've had the ability to abuse this all along and haven't is a good indication that they are not likely to do so in the future, barring some unforeseen changes.

Re: Still abusive

[Rob Simpson]

You own games you buy in Steam. Waiting for a sale is not renting. I don't know what gave you that idea, it certainly isn't in the EULA.

No. You can sell the things you own.

Furthermore if you buy a game you are free to crack it and run it without Steam running, and run it offline.

I doubt that's in the EULA.

I bought Skyrim because it said it just needed Steam for activation. Ha! I won't make that mistake again.

Re:Still abusive

[Em Adespoton]

Thanks! I'm glad you backed up my inbox for me. I'll send you the appropriate hash when I want to roll back to those contents.

I think you miss the point here -- this is a list of hashes Valve has created, not a random list of hashed contents of your DNS cache. They created the original hashes, they're storing the results paired against UID when they find people who match the "interesting" hashes. They know what those hashes represent, and are guaranteed to keep a mapping list.

Your argument is out of context with the thread discussion.

Re:Still abusive

[Zynder]

I also agree with you 100% but that doesn't mean it's ok. They could put in the ToS that you'll let them bang your mom but that doesn't mean it is right or lawful.

Re:Still abusive

[Zynder]

I agree with your sentiment but nothing will change. Blizzard does some kind of anti-cheating bullshit with their Warden software. No one seems to have bothered to sue them and Blizz has actually used it to beat down MMOGlider bot software as mentioned in that link.

Re:Still abusive

[wagnerrp]

The number one rule of writing exploit-free code is NEVER TRUST THE CLIENT. EVER. There should NEVER be ANYTHING a user can do or run on their machine which can give them an advantage or opportunity to cheat... if they can then YOU fucked up when you wrote the code.

In other words, all games must operate in a mainframe/terminal fashion, where the client is just a dumb viewer and all game code is running on a private server outside the user's control. Even then, you would still have to worry about applications running mechanical vision algorithms and guiding the mouse and keyboard inputs autonomously.

Re: Still abusive

[vakuona]

No one is being banned for visiting a website. People are being banned if the software determines that they are cheating, and verifies this by checking to see if they have performed a DNS lookup to servers known to be used for cheating in the games. Basically, they are using the DNS to try and prevent false positives.

If they let the cheats degrade the user experience, they might end up losing their good customers, and this ruins their business.

Basically, the DNS probably only "saves" you if you aren't actually cheating. If you are, then refusal to allow the check may be taken at tacit admission that you are, in fact, using the cheats.

Re:Still abusive

[gIobaljustin]

Saying that they didn't abuse their powers in the past, so they likely won't in the future is, in fact, ridiculous. Corporations change. The people in corporations change. New people come in. The logic just doesn't work.

Re:Still abusive

[Windwraith]

Do you know of any false positive? Because with all the people misunderstanding what's going on, I am surprised nobody has jumped with "I got banned" whether it's true or not.

Out of all the "privacy outrages" this one doesn't even qualify. And they aren't being criticized with the hope of them changing because they already did. Anything else is just FUD at this point.
I know reddit is a nest of weird people but go read the threads where this stuff originated, and then the response. And with read I mean read it, not reading someone else's interpretation of it.
The accusation threads are the most FUD-filled package of half-truths you can see around, it's really worth a check just to laugh at this "incident" that really isn't.

And besides do you know the kind of shit anti-hack programs do? VAC is extremely tame in comparison, hashed DNSs or not.

Re:Still abusive

[Anonymous Coward]

- what if I got my cheat from a friend? I'd never be banned since the DNS verification step marks me as clear. This is not the case. - what if I looked up videos of cheats for a game after encountering cheaters in a game to confirm my suspicions? DNS isn't verifying anything, it's circumstantial guilt by association

Neither of which has to do with checking the DNS cache for accesses to cheat DRM servers. It has nothing to do with where you get the executable for the cheat program, and instead deals with the fact some specific cheats have DRM that connects to specific servers in order to work.

Re:Still abusive

[Windwraith]

Yes, you aren't mistaken, VAC only runs in specific games AND specific servers. I for example don't have any game using VAC in any form (and then again I am in linux, and I do nothing but steam on my windows install)

Re:Still abusive

[d33tah]

Hashing is just not going to help there. The DNS domain space is basically so little that it could probably even be bruteforced offline, not to mention web crawlers. You can easily download the rDNS for the whole internet as of 2012 from Internet Census 2012 database for free (http://internetcensus2012.bitbucket.org/paper.html). While it's not forward DNS, I would expect to get a very high match rate just by hashing it all. Definitely feasible.

Re:Still abusive

[squiggleslash]

The fact that you can use some of the same terms to describe entirely different things doesn't mean that someone is applying a double standard if they agree with one thing and not another.

The message you're responding to actually makes it clear that this is not an example of "the bad thing". It was a correction to drivel people are posting because, well, they hear "Valve is digging through your cache" and think that Valve is indiscriminately looking at your cache, and sending private information it has no right to know.

People are suggesting that Valve is sending your entire DNS cache to Valve so it can look for cheating. This is wrong. It's not true. That is what I was correcting. Valve is not receiving anything from your computer beyond a yes/no flag as to whether a particular DNS lookup was made recently, where that DNS lookup would not be a user initiated event.

When people are upset about "digging through your machine", they're worried not about an anti-cheat algorithm sending a yes/no answer to the question "Is Frobnicator cheating", they're worried about a long answer to "What has Frobnicator been doing recently?"

Your comment ignores nuance, ignores differences, pretends that disimilar things are similar, and equates flawed anti-terror policies that invade privacy and harm innocent people with locally stored logic that confirms if you've been cheating on a game, and then only if there's reason to believe that. Your attempt to promote an aura of aloof objectivity falls flat, it's absurd, and you should know better.

Re:Still abusive

[konohitowa]

Oh, for Pete's sake. Stop RTFA! How do you expect this circle jerk to maintain itself when you keep polluting this thread with your "facts" and "reason"? Jerk.

Re:Still abusive

[Frobnicator]

The message you're responding to actually makes it clear that this is not an example of "the bad thing". It was a correction to drivel people are posting because, well, they hear "Valve is digging through your cache" and think that Valve is indiscriminately looking at your cache, and sending private information it has no right to know.

When people are upset about "digging through your machine", they're worried not about an anti-cheat algorithm sending a yes/no answer to the question "Is Frobnicator cheating", they're worried about a long answer to "What has Frobnicator been doing recently?"

No, that is exactly the point I was trying to make. There was nothing accidental about it.

It is everywhere. Just minutes ago I read a news report on license plate scans. The police are adamant: We only send results back if there are illegal immigration concerns, we don't look at anything else, and we only transmit the data if there is a match.

That's great that they don't send the whole thing back for evaluation, because that would be blatantly evil and would invite the pitchforks.

EITHER WAY, government organizations or business organizations or criminal organizations, the organizations are paying a visit and digging in to potentially valuable, potentially incriminating, and always very sensitive personal information.

Both the government agencies and the business are clear about it: THIS TIME they are only using it for good. THIS TIME the scans won't be archived or searched. THIS TIME we use it identify specific bad guys. THIS TIME we are invading your privacy for a good cause.

The doctor may say "THIS TIME I am sticking my hand up there to check for colon cancer, nothing to worry about." I don't care how many times it happens, I want to know EVERY TIME. I want to know well in advance EVERY TIME they want to poke in. I want to know EVERY TIME what they are doing, why they are doing it. I want to know EVERY TIME so I can check the results and monitor them and make sure that THIS TIME is still acceptable to me. Because maybe THIS TIME it is not.

Re:Still abusive

[netik]

Clearly you have not heard of salting a hash. That's what stops the rainbow table attack you describe.

On the other hand, going through my DNS history is a violation of my privacy and I'm not going to play this game.

Re:Still abusive

[jamiedolan]

Soon the fine print will allow them to search my basement and review my medical records without further notice or warning. Slippery slow, and sadly we are already sliding down it.

Re:Still abusive

[Anubis IV]

I don't deny that the situation can change, and I even explicitly said so. All I claimed was that we have a good indication that they are not planning to abuse their power. Could they later? Sure. But if they were currently intending to do it, wouldn't they have already done it in the 10 years prior when they had the opportunity and motivation to do so yet didn't?

Re:Still abusive

[Xest]

This is sensible advice. I wrote an aimbot, speed hack, and auto dispenser detonate for Quake/TF but I only ever used it on a private server with the full knowledge of everyone else on the server because I was well aware of both the consequences of it's use and the ethics of using such a thing (frankly, I fucking hate cheaters, and I hate hypocrits, so it'd be stupid to ever use it live).

It was one of the most valuable learning experiences I've ever had, I learnt a hell of a lot about network programming, Windows internals, security, and game math.

It's a thing that I'd absolutely say is worth doing as a learning experience without a doubt, but don't ever actually do it in a manner that genuinely effects other players at least without their consent, otherwise you get what you deserve.

Re:Still abusive

[bingoUV]

But most applications you install on your computer/phone/server could abuse their powers. If not right now, maybe in future when you install "security" updates, since corporations change.

I don't see you complaining this about emacs.

Re:Still abusive

[jittles]

D: D: D: OH NOES THE SKYNET IS FALLING!

No, they're looking at your DNS cache. What you read was stupid, and you got worked up and stupid about it, and now you're continuing to be stupid when it has been shown that this is a non-issue.

Gamers are the dumbest people in the world, especially when they think they know how something technical works. There is, in fairness, a small amount of people who have deep knowledge of computers, and who also play video games, but keeping up with tech typically requires a great deal of leisure time spent in study. The more the word "gamer" describes you, the more likely you are to be a semi-literate luser.

Just to recap, your first sentence was misinformation, and the second one is simply false -- it does not follow that tracking one protocol would necessitate tracking others, and even if they were doing real-time monitoring of DNS, which they are not, watching all network traffic would be far too low a SnR to be useful for anything. Play around with wireshark sometime, you will see why. But first stop dragging down our SnR and read the rest of the comments.

How is reading my DNS cache not monitoring my network activity? THey may not have my NIC in promiscuous mode but they now know every local and remote host I have used DNS to connect to. That's none of their business. If they want to make sure I'm not running a cheat program by scanning my memory during the execution of the game, then fine. go for it. I expect that. I don't expect them to be snooping through everything I've done since my DNS cache was last flushed. That's spying, its easily circumvented via proxies and flushing my DNS cache, and there is no reason or excuse for it.

Re:Still abusive

[gIobaljustin]

But most applications you install on your computer/phone/server could abuse their powers. If not right now, maybe in future when you install "security" updates, since corporations change.

Yes? That's why I try to limit my exposure to proprietary software, as those companies have proven themselves to be untrustworthy. Valve already has, as we see here. The fact that they'd even do this shows that they lack morals.

I don't see you complaining this about emacs.

Do I have to complain about everything I have a problem with, lest you assume that I have no problems with the things I didn't complain about?

With that said, I usually wait for a while after an update comes out to begin with.

Re:Still abusive

[Giblet535]

I think Valve's DNS check is a good start, and an excellent way to someday backdoor a PC with the user's permission. What kind of terrorist activities are you up to, that you would question authority in the way some here are doing?

Re:Still abusive

[vilanye]

The best way to avoid having your game overrun by cheaters is by making it near impossible to cheat on it.

But that takes actual skill and effort unlike using invasive cheat detectors.

Re:Still abusive

[Ash Vince]

The best way to avoid having your game overrun by cheaters is by making it near impossible to cheat on it.

But that takes actual skill and effort unlike using invasive cheat detectors.

Your post is pretty light on details of how to do that, what do you recommend?

For instance on many FPS the cheats overlay something over the game graphics indicating where other players are on the map, effectively allowing you to see through walls. The game itself running on your PC has to known what is on the other side of the wall so you hit them if you shoot through it, a cheat (running as admin) can eavesdrop on the memory the games uses, extract info like this and the display it to you.

This is the big problem, the cheat software usually runs with elevated privileges and can then use them to inspect the memory the game uses. I guess the game could try and encrypt everything it stored in memory in real time but I am guessing that would incur a performance hit.

You could try and push more stuff like this to the server so only the server knew where everyone was and your own running copy of the game only knew about people you could actually see but that means so much stuff is bound by your network latency.

Then you have the problem about using the same overlaying technique to help identify targets at distance or camouflaged. In this case they can show up on normal players screens so the local running copy of the game has to know about them, but you can overlay a bright red outline or something to make them stand out as part of your cheat software.

Re:Still abusive

[hobarrera]

I belive this applies to windows only. I don't other OS's allow any program to scan the memory of other programs.

Also, even in windows, can't you just run steam as a different user than the cheat itself?

Re:Still abusive

[Actually, I do RTFA]

Use an OS that prevents on application from rummaging through your computer.

Suggestions please?

Re:Still abusive

[jader3rd]

The only two that I know of are Windows RT and iOS. They have the problem of being a walled garden, but that doesn't mean that a non-walled garden OS could be created where an app is only allowed to see what it bring to the table, and what the user gives to see.

Is it in the TOS?

[NotQuiteReal]

Is this search in the TOS, or is it an "unauthorized" search?

Re:Is it in the TOS?

[interkin3tic]

You ask that as if ANYONE has any idea what is in the TOS. I assume it's standard TOS stuff like you won't sue us for any reason ever, we own you and can do whatever we want, you own nothing, you pledge your soul to serve in our undead army against God in the end days... That probably covers these searches.

Re:Is it in the TOS?

[Raenex]

you pledge your soul to serve in our undead army against God in the end days...

Sorry Valve, that one has to be signed in blood.

Re: Is it in the TOS?

[Sowelu]

If you're in a poker tournament, and there's a guy standing behind your opponent telling you what cards he has, is that free speech as well?

Re:Is it in the TOS?

[Japher]

I'm fairly certain that my ISP can't authorize a third party to conduct searches on my local computer. If VAC were asking my ISP for DNS history, you might have a point... but that's not what was happening here.

How common is cheating with VAC?

[Galaga88]

I know in the olden days, I just assume everybody else was cheating (they usually were) but how common is cheating now that VAC has been around for a while?

Re:How common is cheating with VAC?

[feedayeen]

I think that this is a, 'we don't have any gays in Iran,' type of situation.

Re:How common is cheating with VAC?

[CastrTroy]

This is why I don't like the idea that games seemed to have moved away from hosting your own server. Online games were great when you knew the guy you were playing against. There wasn't as many problems with cheating, or perhaps you could agree on which cheats could be used, and the in-game chat was a lot more tolerable. Now that you're just playing against a random selection of people from the internet, I just don't get as much enjoyment out of it.

Re:How common is cheating with VAC?

[drinkypoo]

This is why I don't like the idea that games seemed to have moved away from hosting your own server.

Sadly, even most of the games with random matching force one of the players to serve as the server. Only MMOs really work in the way you describe.

Re:How common is cheating with VAC?

[KermodeBear]

Like you I imagine, I've been playing online games for a long time. I even ran a half dozen TFC / Natural Selection / CounterStrike / Half-Life Deathmatch / etc. servers for three or four years. I never found cheating to be common except for CounterStrike. For some reason that game attracted cheaters like crazy. The other games, not so much. Cheating wasn't just uncommon - it was rare.

When PunkBuster and similar products became popular it was amazing how much better I became compared to other players when playing on a protected server. (o:

VAC has, in my opinion, done a very good job overall of keeping up with the cheating crowd. I can't remember the last time I came across a player that I suspected of cheating - and having had to do detection manually by watching player behavior, I'm very confident in this.

There's a few things you can look for manually when looking for cheaters.

Your typical aimbot is easy to detect. Jump into spectator mode or whatever and pick the first person view for the selected player. Instead of the smooth movements a typical player will have, you'll see the player's aim snap to positions on a screen. It's rare to see these anymore because detection is so incredibly easy.

Driver hacks to provide see-through textures, or model hacks that have a long cross through them that extend through walls, are also pretty easy to detect by watching the player. Is someone across the map and scoring head shots through walls? Does he always seem to know where the enemy is? He's using one of these.

The interesting cheat is the second one (wall / model hacks) which allows one to see opponents behind objects, because it's not a mechanical advantage like an aim bot; it's a strategic advantage, an information advantage. It doesn't change the ability of the cheater to aim more accurately; it changes the cheater's behavior. A player without the cheat information will act as if the opponent is not there; a player with the information will.

So, you'll see tactical advances / retreats, shots fired / grenades thrown, etc. that would not occur in normal non-cheating game play. Yes; there will always be the person who gets the lucky what-the-hell shot. That happens.Sometimes more than once. What you need to look for is a consistent pattern over time that cannot be attributed to simply being "good", having a better overall strategy, or having an unusual play style.

I bet that with enough information collected it would be possible to detect this kind of behavior and flag individual players for follow-up manual inspection. It would be a fascinating bit of research, really.

Resource hacks are very dead these days, as information about resources (ammunition carried, money earned, life amount, etc.) are all stored server-side for most games. There's no way for the client to fiddle with that data.

Re:How common is cheating with VAC?

[Luckyo]

I think that's the negative part of it. Scanning user's DNS and doing something with it is a massive red flag today in post-Snowden world. Even though you told us what you're doing with it, as a US based company, we know that US companies that harvest data are basically nothing but NSA fronts when it comes to spying and your trustworthiness in things like "scanning user's machine for private data" is in negative by default in today's world and no there's nothing you or us can do about it other than start financing people who would be against it into US legislative and executive branch. It's not even up to you as CEO - as a big company you have NSA moles who will do it without you ever knowing it or intending it.

As a result, I would argue that purging less than a thousand cheaters out of pool of tens of millions of players is far too little of a benefit for such a draconian measure. The medicine is far more destructive than the amount of disease it helps to cure.

Re:How common is cheating with VAC?

[PhilHibbs]

That's what friend lists are for. I only ever play Counterstrike online if I see a friend online, and *click* I'm on the same server he or she is on.

Re:How common is cheating with VAC?

[jandrese]

It's certainly not perfect, but it helps. Reducing the load from "everybody cheats, get over it" to "you can kick the occasional cheater you find from the match" is a huge improvement.

Re:How common is cheating with VAC?

[Lothsahn]

When I was in college, my friend had a roommate who played CS nearly all the time. His roommate actually failed out of college because all he did was CS.

While I think most of your points stand, I can say with 100% certainty that he acted like he could see through walls. He was so good that he routinely killed people (with headshots, even) through walls. Had I not seen his monitor with my own eyes, I would have known he was cheating. He was frequently accused of cheating. In fact, he could only play on his clan's server because he'd get banned nearly everywhere else. He'd routinely go 51/2 K/D in a match. Sometimes when we played with him, we would all have to reassure people that he wasn't cheating by vouching for him.

Just something to think about before anyone accuses a really elite play of hacking. What they can accomplish is rather insane.

Re:How common is cheating with VAC?

[Rakarra]

This is why I don't like the idea that games seemed to have moved away from hosting your own server.

Sadly, even most of the games with random matching force one of the players to serve as the server. Only MMOs really work in the way you describe.

I think Blizzard's non-MMO games use game servers instead of having one person host. Diablo 3, Starcraft II, etc. Though Starcraft 1 did make one person host, and that caused chaos when one person has a slower (dialup) connection than everyone else (dsl).

Re:How common is cheating with VAC?

[DrGamez]

570 players caught with this one test over the short one/two week period.

The reason hackers don't seem to be much of a problem is because: vaccines^H^H^H^H^H^H^H^H VAC works.

Re:How common is cheating with VAC?

[LesFerg]

heh, you don't take into account paranoid players, who act as if there is a bad guy behind every wall. I just naturally use that strategy :)

Re:How common is cheating with VAC?

[Windwraith]

You underestimate the effect of cheats on an online game. Basically since the game is unwinnable because of those 570 players, people stops bothering and will only remember the game as a cheat-infested hellhole.
Those people targeted by this VAC procedure PAID for their cheat tools. That's the real news here, that people are sad enough to paid for cheat programs. Cheat programs WITH DRM.

When people can go to such lengths, expect their effect to be noticeable.

Re:How common is cheating with VAC?

[LeeRyman]

I am a senior game admin for a relatively large gaming network.

I tend to find VAC is delayed by a couple of months. Every once and a while a new edition of a cheat will come out and we see an influx and peak of reports and first-hand cases. Some people are really stupid (spinbots, snap-happy, etc). Others are more cunning (trigger-bots, wall-watching). Eventually that edition is detected by VAC and the problem mostly goes away until the next revision is released.

Similar to what KermodeBear described, there is a fairly rigorous review process for demo's before we place a ban. We ensure that it is beyond reasonable doubt - covering off other 'indicators' like game sounds, radar, good tactical awareness, deaths of other players, etc. It can be difficult at times and we err on the side of caution (we would rather a cheater or two go free than ban an innocent player). As KermodeBear eludes to, sometimes the easiest way to initially spot a cheater is when the server suddenly starts sending data about an opposing player as they come within range, and the waller involuntary reacts to the new information. Think when you are playing a game legitimately and a enemy player walks around a corner in front of you - you react automatically in-game by stopping, shifting your aim, shooting, maybe moving to cover. Wallers do this when they suddenly see people though textures, and they react in a similar manner. It sticks out like a sore toe, and definitely prompts us to look for more evidence.

I know that for some games (BF series and an old CSS mod come to mind) there are cheat predictors which capture such events and provide a cheating probability. They can work quite accurately, but we don't use them to 'convict' someone.

Most cheaters actually play very poorly from a tactical and strategic point of view, and can often have very average scores as a result (unless they are aimbotting, which is pretty obvious). And they all get caught eventually, few of them are terribly bright when it comes to taking best advantage of the hacks. Some even forget to turn off the automatic say spam that the cheat sends. It may as well say "BAN ME NOW".

(Actually, the biggest reason for bans on our servers at the moment is derogatory, racist or abusive language. We can't and don't tolerate it much at all. I have no idea why some players cannot go 10 seconds without calling someone else a part of the female anatomy)

Re:How common is cheating with VAC?

[Andtalath]

So play with your friends...

Not sending history to Valve

[pavon]

The biggest part of his announcement is that this checking is done client side; your DNS history is not sent to Valve. They also only record MD5 hashes that match the cheat sites they are looking for, not your entire DNS history. Finally, they claim to only check for DNS lookups of servers used by the cheat software itself, not just websites where you might read about and download cheats (although in some cases I imagine these could be the same), and use this as a second check after the client has already detected a cheat installed on you machine. So simply visiting cheat software websites without using them shouldn't get you banned.

Re:Not sending history to Valve

[CanHasDIY]

Why couldn't they just MD5 the files for the actual game, to verify that they match with the official binaries? Seems a lot less intrusive, and less potential for abuse.

FWIW, it shouldn't matter what information I discover; what matters is what I do with it. Maybe I hack games, maybe I like to visit the sites that teach you how so I can understand what that means; either way, unless I'm using the knowledge I gained from game-hacking websites to.. er, well, hack Steam games, then IMO it's none of Gabe's fucking business what websites I visit, nor anyone elses.

Re:Not sending history to Valve

[Anonymous Coward]

Cheats have evolved beyond file tampering. Most are done with code injection, and boy is that history a long one. I suspect the actual DNS being hunted for are the cheats' "DRM" servers that ensure you paid the guy who made the cheat money. CheatHappens.com or whatever they're calling themselves these days was one of the first to start doing this in a big way.

Re:Not sending history to Valve

[Anonymous Coward]

Why couldn't they just MD5 the files for the actual game, to verify that they match with the official binaries? Seems a lot less intrusive, and less potential for abuse.

A lot of anti-cheat systems already do things similar to that, but it only catches one category of cheats. It doesn't help so much for cheats that change the game after it is loaded into memory, ones that change behavior of the video card that make things easier to see without touching the game, and ones that help control inputs without editing the game.

maybe I like to visit the sites that teach you how so I can understand what that means;

Then this check won't flag you, because that is not what it is looking for. Various cheat programs these days have their own DRM system because the makers want to make money, yet know what type of crowd they are dealing with. The anti-cheat software is said to be checking for connections to the DRM validation servers for known cheats, not to websites by or about the cheats.

Re:Not sending history to Valve

[szap]

Don't need to change the actual files to patch it. See DLL Injection: http://en.wikipedia.org/wiki/D...

Re:Not sending history to Valve

[Cheburator-2]

I suspect the actual DNS being hunted for are the cheats' "DRM" servers that ensure you paid the guy who made the cheat money.

Imagine, Newell said exactly this. Only DRM sites, not web sites. How did you guess it?

Re:Not sending history to Valve

[dave562]

Often times they are not modifying the binaries themselves. The cheats are separate DLLs that are injected into the process at run time.

Re:Not sending history to Valve

[frinsore]

Checking the MD5 hash is one of the oldest methods of anti-cheat. Nowadays file hashes are signed by a private key and verified locally with the corresponding public key, if the hashes don't match then it's an invalid file. But like I said, this is one of the oldest methods and has been worked around for years. The simplest method is to modify system dlls that the executable depends upon to inject code into the running game. This then leads to signing everything that the executable could depend upon. The next easiest method is to launch the executable, pause execution, overwrite some data/functions, and then resume. This has been combated by having the executable live at a random offset. Instead of the executable living at 0 in memory it could live at position 1024 or 756.

The problem is that all anti-cheat software is essentially DRM and running DRM on am open platform like a PC is inherently problematic.

Re:Not sending history to Valve

[blincoln]

Most cheating involves modifying processes in memory, not the files on disk.

I do agree that it's really heavy-handed of Valve to ban players over DNS entries, though. What's to stop me from posting a page on some heavily-trafficked site with embedded image tags pointing to those systems (they may not load, since who knows if the cheat servers are even running web server components, but visiting machines will still cache the DNS entries), trying to get anyone who visits it banned on Steam?

Re:Not sending history to Valve

[The MAZZTer]

If it just MD5ed fhe files, the games would be hacker heaven, since you don't need to touch the files.

There are tons of ways to do this. You can attach a custom DLL to run code, or just inject code directly. You can do this when the program starts up even before it has a chance to run any code itself. You could modify your graphics driver to change the way the game renders so that the game itself sees everything about itself is fine because it is.

Also, files for the actual game are hashed, at least in Source. That is an sv_pure check and is not a VAC thing (though working around it would trigger VAC).

Re:Not sending history to Valve

[Anonymous Coward]

Why was this modded down? This is right. You can't trust proprietary garbage.

Re:Not sending history to Valve

[Sowelu]

Yes, and you can't trust the guys who do steroid testing in baseball, either. Who knows what they are doing with your precious bodily fluids?!

Re:Not sending history to Valve

[Rakarra]

I suspect the actual DNS being hunted for are the cheats' "DRM" servers that ensure you paid the guy who made the cheat money.

Imagine, Newell said exactly this. Only DRM sites, not web sites. How did you guess it?

He has access to a magical scroll of knowledge that tells him more details about a story than what the Slashdot summary says. It's a remarkable device!

Re:Not sending history to Valve

[fph il quozientatore]

I suspect the actual DNS being hunted for are the cheats' "DRM" servers that ensure you paid the guy who made the cheat money.

So, this raises the question: is there a meta-cheat that cracks the DRM?

Re:Not sending history to Valve

[DrGamez]

We need transparency, says the person who has not even bothered to commit a username to this thought.

Valve vs NSA

[Anonymous Coward]

I trust Valve more than the NSA.
The NSA doesn't protect me against hackers.

Re:Valve vs NSA

[coolsnowmen]

I trust Valve more than the NSA.

Of course, becaues Valve has no actual power over me to get me sent to guantanimo.

But still: LOW BAR!

Re:Valve vs NSA

[Luckyo]

NSA thanks you for your useful idiocy. As a large company, Valve just like its peers is thoroughly infiltrated and your data is siphoned as deemed necessary in the name of national security.

Whoosh

[wjousts]

No need to check your DNS history to tell you haven't visited OhNowIGetTheJoke.net

Misleading article... read the real post by Gabe

[Anonymous Coward]

They did not look at DNS histories of your browsing... there are cheats that have their own DRM that phone home to the cheat server to make sure you paid for the cheat (/irony). All Valve was looking for was the phone home to the cheat servers, not your bloody porn searches, or even visiting a cheat website.

Why do we still allow this sort of overeach?

[green1]

The more I see stories about various programs accessing all sorts of stuff they aren't supposed to, the more I wonder why we still allow this? I use my browser for something, there shouldn't be any other program on the computer that knows about it. It's time we eliminate this idea that every app has access to every file on our computers. I really don't understand why sandboxing every app is not only not the default, but also very rarely even available on most operating systems.

It seems these days most apps are hostile to the users, it's time we treated them as such and stopped letting them have the run of our computers.

Re:Why do we still allow this sort of overeach?

[dave562]

We tolerate it because cheaters ruin games. If do not want to play the game, or do not want your privacy violated, then do not play games on Steam.

For those of us that do play games, and do play them honestly, this is another step in the right direction. Cheating simply kills these games. I am willing to give up a bit of privacy in exchange for fewer aimbots and wallhacks in the FPS games that I play. If you read the article, or the comments, you would realize that the DNS scanning is a second level of review that takes place when other indicators point towards a person who might be cheating.

Re:Why do we still allow this sort of overeach?

[Kardos]

> It seems these days most apps are hostile to the users, it's time we treated them as such and stopped letting them have the run of our computers.

Well that the tradeoff when it comes to closed source software. You have to trust that the provider of the binary is Not Evil.

> It's time we eliminate this idea that every app has access to every file on our computers.

Mobile has made some progress here with "App Permissions", such that you can limit what an app can do. It's easy to do this when you build a new system, apps have to conform to it. With PCs, the "app can do whatever it wants" has been standard for years and it'll be hard to change it.

Re:Why do we still allow this sort of overeach?

[Ardyvee]

Don't use VAC. AFAIK (correct me if I'm wrong), it should only be activated if you join VAC-enabled servers. VAC is specifically Valve's Anti-Cheat System and it does what it says on the tin. Although I guess I do agree on the whole sandboxing thing. But you still have the problems of cheating in online games.

Re:Why do we still allow this sort of overeach?

[green1]

This particular case has a "noble" goal, but the exact same techniques could be used for much more nefarious purposes. There is no good reason why it is even possible for an app to do this.
Apps should NEVER have access to anything outside of themselves without explicit permission. There is no good reason for it, and it causes huge security holes.

Re:Why do we still allow this sort of overeach?

[green1]

Mobile has not really done any better. most mobile OSs will tell you what permissions an app is asking for, but won't allow you to select which ones to allow. In addition, the apps are still not fully sandboxed. For example on my android phone I have an app that won't run on rooted phones. It doesn't request root permission, so it SHOULD have no possible way of knowing I'm rooted, however it has full access to the file system (without any special permissions) and therefore can figure it out on it's own.
It's time we stopped letting apps have the run of our devices. Developers have repeatedly proven that they don't trust their users, it's time we stopped implicitly trusting them.

Re:Why do we still allow this sort of overeach?

[green1]

This particular case may have a "noble" goal, but the exact same techniques could be (and probably are) used for much more nefarious purposes. There is no good reason why it is even possible for any app to do this.
Apps should NEVER have access to anything outside of themselves without explicit permission. There is no good reason for it, under any circumstances, and it causes huge security holes.

Re:Why do we still allow this sort of overeach?

[jader3rd]

The more I see stories about various programs accessing all sorts of stuff they aren't supposed to, the more I wonder why we still allow this?

It's because we like it when programs work well together. As a result general purpose computers have the model that anything running as the user is the user. So preventing one application from interfacing with/messing with another program would be the same as blocking the user from doing the same. Any OS that tries to put up garden walls between programs is decried as an attack on computational liberty.

Re:Why do we still allow this sort of overeach?

[Luckyo]

For those of us actually playing games, it's a massive leap in the wrong direction. I'll take ten times the amount of cheaters they banned with this in my games if that means they do not violate my privacy.

Re:Why do we still allow this sort of overeach?

[gIobaljustin]

So in other words, you tolerate it because you care more about the safety of your DRM-infested, proprietary games than you do about what these applications are actually doing. Such integrity.

Re: Why do we still allow this sort of overeach?

[gIobaljustin]

Then it should also be common knowledge that people should stay far away from their proprietary garbage. To do otherwise is to admit that one is profoundly ignorant.

Re: Why do we still allow this sort of overeach?

[green1]

Did your OS stop it from accessing random files on your hard drive until you gave it permission to do so? If not, are you saying that you have no problem with EVERY application on your computer having similar access to snoop through every file on your hard drive and tell whoever it likes?

Just because you happen to like what this one piece of software does, doesn't mean it isn't doing it in a way that should concern us about what our systems allow with no checks and balances.

Re:Why do we still allow this sort of overeach?

[dave562]

Exactly. As part of playing the game, I am willing to give up privacy in order to have to deal with fewer cheaters making up for their lack of skill (and ruining my game experience) with hacks and exploits.

It has nothing to do with "safety" of the games and everything to do with the quality of my playing experience.

They are already running an executable that is scanning memory in real time. Who cares if they are digging through DNS cache?

Everyone who responds to this about privacy in video games is barking up the wrong tree. The real privacy violations are happening upstream, at the ISPs with the full support of numerous three letter agencies. I am more concerned about the NSA colluding with Microsoft than I am with Valve scanning my DNS cache for servers used to authenticate cheats.

Re:Why do we still allow this sort of overeach?

[green1]

All I ask is that the OS asks first. and ideally gives you the choice of allowing, denying, or faking the results.

If I want my email program to be able to load an attachment to forward, I'll tell it that's ok. If some random game wants to see what my browser did last I'll either deny, or give it false info. (I don't cheat, nor do I visit cheat sites, but I also don't think they have any right to know what sites I do visit)

Re:Why do we still allow this sort of overeach?

[dave562]

The app already has explicit permission to go outside of itself. VAC is scanning memory when the game is running to detect cheats. THAT is way more invasive than doing a second step verification of MD5 hashes generated from the DNS cache.

There is a good reason for it. The reason is to reduce the instances of cheating. If you do not agree with that, do not play the games. I am willing to guess that you do not play very many FPS games, so you probably do not have to frequently deal with the frustration of being instantly killed by people you can barely even see. Nor do you deal with the frustrations of players knowing where you are at all times.

Re:Why do we still allow this sort of overeach?

[gIobaljustin]

So the addict speaks.

The real privacy violations are happening upstream, at the ISPs with the full support of numerous three letter agencies. I am more concerned about the NSA colluding with Microsoft than I am with Valve scanning my DNS cache for servers used to authenticate cheats.

X being worse than Y does not mean that Y isn't bad. All of these are real privacy violations, all of them are bad, and you really have no idea what this proprietary garbage is doing. Your logic is bad.

Re:Why do we still allow this sort of overeach?

[Sowelu]

Good god! I can only imagine all the nefarious purposes that drug testing companies use my samples for when I get tested for a job! Why, maybe they're even trying to pull my DNA out of them and sequence it so they can sell it to who-knows-what evildoers! If only a tinfoil hat worked for that.

No. I give VAC explicit permission, and it does its job. No VAC, no online games worth playing.

Re:Why do we still allow this sort of overeach?

[Luckyo]

I played games ever since duke nukem 3d over heat.net over 28800 baud modem days, thank you very much. I imagine I've met more cheaters than most people.

And while nothing "stops me from playing on vac free servers", nothing stops steam from running vac DNS checks on me either.

So the idea of the day is "understanding the issue, not being utterly stupid and posting as AC to cover it".

Re:Why do we still allow this sort of overeach?

[green1]

So you're ok with your word processor telling it's owners every website you've ever visited, and possibly your online banking info that was in your cache too while it's at it? how about your image viewer? that weather widget should be able to access every file on your computer and every register in memory too and phone it home, why not? after all, you gave it "explicit permission" (the same permission you gave VAC, a simple install, your OS didn't ask for more.)

The point is that whatever you think of this particular use, it just shows how we don't handle any form of security from the biggest threat on our computers, the apps we install. This SHOULD have come out when the first user installed it and his OS asked permission, instead it came out after people discovered it through other means. There's just no excuse for our OS (and I mean every common OS out there) allowing this by default for every single app.

The people and companies who write the apps don't trust us, so why do we continue to implicitly trust them?

Re:Why do we still allow this sort of overeach?

[ravenlord_hun]

I hope you don't run any anti-virus/malware software either, then. Because, you know, they use almost exactly the same methods (RAM, registry, full HDD scan and reporting home) for exactly the same ends - that is, preventing software they deem harmful from running.

Re: Why do we still allow this sort of overeach?

[ravenlord_hun]

Whether you use those things or not makes little difference as long as the underlying OS allows such things to happen. If people stayed away from VAC in protest, they would only give an absolutely free reign to cheaters who don't give a hoot about such ethical concerns.

This is a technical answer to a technical problem. Or do you have a better solution, short of no-one playing multiplayer on servers they don't host themselves?

Re:Why do we still allow this sort of overeach?

[jellomizer]

Well for one, I know a lot of gammers hate to hear it, IT IS JUST A GAME! If you don't like it don't play the game.

Secondly Cheaters really ruin it for everyone else. Most players play online because they want to test their skills against others using the fixed set of rules. I remember being impressed when I played War Craft II and I found my unintended army gone, with no alerts. Just because they were all turned into a bunch of sheep. Annoying yes, I didn't care to loose however the player was being creative with the rules in the game.

  If you want to win base off of cheating, you should find a server for cheaters and see who's cheats are the greatest.

Re:Why do we still allow this sort of overeach?

[gIobaljustin]

I don't run proprietary software, period. I'm the only one who should decide if software is "harmful," and Valve certainly shouldn't decide that software I installed on my computer is harmful for me.

Of course, again, this is why I don't use proprietary junk to begin with.

Re: Why do we still allow this sort of overeach?

[green1]

So your excuse is because this one application has a use you like, all OSs should allow ALL applications free reign.

This is a technical answer exploiting a security hole that shouldn't exist to try to prevent a social problem. If people stayed away from VAC in protest it wouldn't fix the underlying broken concept in every OS that says apps should have free reign over the system.

The problem here is not VAC, the problem is the OS allowing every single app unlimited access to the system, something we should not be allowing.

Re:Why do we still allow this sort of overeach?

[Kardos]

I can't speak for android, but BB10 gives pretty good control over permissions. There are a bunch of categories that you can control access (GPS location, phone, contacts, email, text messages, stored files, internet, etc). Many apps that request permissions will still run without them, for example a weather app can get location from GPS if you allow it, otherwise you specify the location you want the weather for. Of course, some apps won't run if you don't give them all permissions - these get promptly deleted.

Re:Why do we still allow this sort of overeach?

[green1]

Then I can give them permission to do so.
The OS should assume the worst from any application asking for access outside of itself, and let the user decide. I should be able to give it access, deny it access, or fake the results.

The problem here isn't what VAC is doing, the problem is that any app can do this without any oversight at all.

As a side note, anti-virus and anti-malware wouldn't be issues if we stopped this ridiculous idea that every app should have full and complete control of the user's system.

Re:Why do we still allow this sort of overeach?

[green1]

I think you misunderstand me, I'm actually not complaining about what VAC does, I'm complaining about what our modern OSs allow EVERY app to do. Not using this app doesn't fix the underlying security concern that every app on my computer has the same access and can do whatever it wants with the information.
This is what we need to fix. Our computers need to stop blindly trusting every app.

Re:Why do we still allow this sort of overeach?

[green1]

Sure it does, it just doesn't do it using the browser. it checks what DNS lookups you've made, and assumes that it's the same thing (which it pretty much is for this purpose)
The problem is, it shouldn't have access to read that file. Only your DNS resolver should. Security on modern OSs is a big problem, the fact that none of them take it seriously, and all of them allow every piece of software to do whatever it likes on your computer is what needs to change.

Re:Why do we still allow this sort of overeach?

[green1]

By default android takes an all or nothing approach, it tells you what permissions the app wants, and you decide if you want to install it or not. There are however 3rd party solutions for rooted phones which allow you to deny specific permissions and these work well (for example I told my weather app that it didn't need permission to vibrate the phone, I'm capable of deciding when I want to look at the weather). The problem here is two fold though:
1) you can allow or deny, but you can't fake, which means if an app decides not to run without reading your contact list to show you the weather, you can't show it a blank contact list to trick it in to running, I think you should.
2) and this one is more important. Accessing arbitrary files all over the internal file system (such as what VAC is doing in this case) is not considered a permission, it's allowed by default, and is not one of the things you can block, or even see if the app needs.

This is ridiculous. I could deny every permission in android, and a program like VAC could still read my DNS cache. Now I could stop it from contacting the internet, but obviously that's something I want an online game to be able to do. So even the most "advanced" OSs we have today in this area, STILL don't stop apps from accessing random files that they have no business accessing. This is a major security concern.

Re:Why do we still allow this sort of overeach?

[gIobaljustin]

Secondly Cheaters really ruin it for everyone else.

"Well for one, I know a lot of gammers hate to hear it, IT IS JUST A GAME! If you don't like it don't play the game."

???

Re: Why do we still allow this sort of overeach?

[ravenlord_hun]

Ah, I think you misunderstood me; I was approaching from the other angle. My point was: since all desktop OSes today give apps free reign - stuff like VAC is neccesary. Just like anti-malware, anti-rootkit, etc softwares - all of them neccesary in the given environment, even if it'd nice not having them running in the background 24/7.

Even Android - a relatively secure linux with some seperation between processes - will gladly allow you to mess around with any process, once you are root. So if you want to alter a process (inject cheat into a game, say)... then it won't stop you.

I understand the theory of having a properly compartmentalized OS (hypervisor running only completely sandboxed apps, etc), and I wouldn't mind having one. But, the thing is: we don't. Not in a state where they could run the majority of the apps we need an OS for today, anyway. Even so, we still want to play games. And without cheaters ruining it for all us, if possible.

Re:Why do we still allow this sort of overeach?

[ravenlord_hun]

You say let the user decide... but that's a ridicolously bankrupt concept. If some of the users weren't wanting to cheat, we wouldn't need VAC in the first place. By allowing the user to do the same poisonous behaviour they do today, you simply didn't change anything! Legit players will still need VAC, and VAC will still need underhanded methods to catch software that also operate unethically.

I agree on the OS part anyway; the OSes that are popular today were designed very, very long ago. But, that's something we'll have to live with for a good while. Designing an OS that would prohibit "super access" for any app by design... while nice in theory, would also require putting together completely new ones. And that's a lot of effort... so I guess we won't really get to see them for a while. Not to mention the inertia that - similarly to any other industry - is present in IT.

Anyway, permissions. You say you give those things permission. Fine. Permission for what? Scan you RAM? Your full HD? Basic requirements as far as antivirus softwares go... but that's way worse than browsing your DNS entries, right there! And some of those scan results will wind up in some global database, or else new virus definitions couldn't be made. So, how do you know what gets reported and how? Will you keep checking the source for all your antivirus apps? Every patch, every commit?

Re:Why do we still allow this sort of overeach?

[rogoshen1]

and thus, the only time in the history of warcraft II that someone actually won playing as human.

Surfing the sites won't trigger it

[Anonymous Coward]

VAC looks for the DRM servers that ensure you're a paying user of the cheat. Check the Reddit post.

Not really

[Anonymous Coward]

Not cheat sites. Specific non-web servers that the cheat software "phoned home" for authentication, since cheats are paid software and therefore have their own DRM. Valve was never even made aware of anyone just browsing a cheat site.

It should also be noted that VAC no longer does this check, as devs of cheat software have figured out how to manipulate their clients' DNS cache.

Re:Visiting a Site Isn't Cheating

[DarkFencer]

Assuming Gabe is being truthful when he states that this is a secondary check triggered by some other evidence for cheating, then just visiting these sites wouldn't be enough.

Its suspicious activity (reported by players? detected through other methods? not sure) that triggers the additional check(s).

Re: Visiting does not imply guilt

[DocSavage64109]

Then it's a good thing that the DNS scan is only for verification purposes in the second stage of the anti-cheat process.

Re:Visiting a Site Isn't Cheating

[newcastlejon]

It's not an issue of viewing cheating sites; Steam is looking for DNS lookups performed on DRM servers (not the Steam ones). Many cheats are paid-for so, in a cruel twist of fate some might say, they use DRM to check if the cheater has paid for the priviledge of doing so.

gaben himself has said that this tactic only lasted a matter of weeks anyway, until the cheatware started futzing around with the player's DNS cache to avoid these checks.

Banned from Battlecraft

[Spiked_Three]

I recently got banned from battlecraft (or whatever it is called) for cheating. That includes, warcraft, diablo, starcraft, others?

But here is the thing; I have not even logged on to play any of those games in over 3 years.

The vendor has come to a flawed conclusion I cheated, and prevented me from playing games I have spent hundreds of dollars for.

Mr Newell, I suggest that some, if not most of your apparent cheaters, are due to YOUR companies lack of technical skill. Stop punishing the innocent for that.

Re:Banned from Battlecraft

[dave562]

Mr Newell, I suggest that some, if not most of your apparent cheaters, are due to YOUR companies lack of technical skill.

While you may suggest that, it is a load of crap and doing so makes you look ignorant.

Cheaters have nothing to do with Valve's lack of technical skill, and everything to do with the client/server based nature of the games. As long as the games are running on hardware that the company does not control, there will be cheaters. It is the age old adage that if the attacker (in this case the cheater) has physical access to the server (or in this case, game client), there is nothing that you can do to protect yourself.

Re:Banned from Battlecraft

[AC-x]

I don't think Mr Newell has anything to do with Battle.net so I'm not sure what you're complaining to him about it for. Have any examples of false positives in VAC games?

Re:Banned from Battlecraft

[Yosho]

Please go on. Tell us how Mr. Newell's lack of technical skill has anything to do with "Battlecraft."

By the way, you should at least learn the name of the service you're complaining about before you continue to make yourself look like a complete moron.

(Hint: It's Battle.net, and it has nothing to do with Valve or Steam)

Re:Banned from Battlecraft

[Spiked_Three]

How does some clowns hacking of my account, make me look ignorant?

Do you you honestly think battle.net is hackproof? And you think I am ignorant?

And for those of you who can not infer simple concepts, I used the words 'The vendor has come to a flawed conclusion' to indicate I knew they were not the same as valve. Sorry I did not take the time to spell it out for some of you (again, I'm the ignorant one (rolling eyes/).

Re: Banned from Battlecraft

[dave562]

You do realize that Battle. Net and Steam are products from two different companies right? You addressed your post to one, not the other.

Re:Banned from Battlecraft

[dave562]

Nothing is hack proof. That is my point, and that is why your comment "cheaters [being] due to [Valve's] lack of technical skill." is an ignorant comment.

Re:Banned from Battlecraft

[Anonymous Coward]

Your discontent is misdirected, friend. Battle.net, along with its associated games - Warcraft, Diablo, Starcraft, etc. - are part of Blizzard Entertainment, which is an entity of Activision. Neither Valve corporation, nor its CEO Gabe Newell, nor its products Steam and VAC, have any affiliation with Activision or Blizzard.

I do agree Battle.net is a ruthless DRM scheme, but I'm afraid it isn't relevant to this discussion. If I recall, VAC itself has quite a low number of false positives, and such cases are handled rather well.

Re: Banned from Battlecraft

[SlippyToad]

I pretty much figured he was ranting and had no exact clue what he was talking about.

I mean, he's not even entirely sure which game he got banned from, and hasn't played it in three years. Are you even sure you're banned? Maybe you just forgot how to play.

Re:Banned from Battlecraft

[SlippyToad]

You ignorantly shoot your mouth off, get virtually every important detail wrong, get called on it, and cry fuck off?

What a jackass. Did you forget to go over and swim in the fucking sewer on 4chan? Sounds like that's where you belong.

Re:Banned from Battlecraft

[jandrese]

Wow, that's quite a troll there. Wrong facts so people can "correct" you, hyperbolic complaints designed to issue the same. It's got quite the feature list.

Re:Banned from Battlecraft

[jxander]

Where to start?

1. It's Battle.Net not battlecraft. That's the actual website in addition to the common name. Mondegreens don't make you sound hip or cool. ("I don't twit on that twatter website, or whatever it's called *harumph*"
2. Valve isn't affiliated with Battle.Net in any way. Maybe if they were, Valve would have apprehended this criminal before they ransacked your account
3. Given 3 years uninterrupted, just about anyone interested could brute force your password by hand. Unsure of the relationship between your issue and DNS checks
4. You haven't logged in for 3 years, which means you haven't played any SC2 or D3 (not that I blame you) D2 characters hosted on Battle.Net expire after a certain dormant period (60 days?) Star Craft ladders reset, so there's really nothing to lose there. At best, they logged into your WoW account and sharded up your level 60 gear. This is such a non-issue, I can't even fathom why someone would WANT that account. There is literally nothing of value there, unless you have continued to pay subscription fees to WoW, in which case they might be using the account to Bot... but that's really not causing YOU any loss. If you've been paying the $15/month for the last 3 years, getting accused to cheating is really the LEAST of your worries

Re:Banned from Battlecraft

[Spiked_Three]

Let me retype me post for those who have trouble connecting the dots;

Another large company, with a large game community, falsely banned me for cheating. It had been some time since I played any of their games. I moved to Seattle in 2010, and I do not believe I played any of the games since I moved here.

It is very possible that that companies lack of technical skills was unable to prevent hackers from using MY account, and that is what lead to the ban. And ANY company in a similar position is likely to make the same mistakes.

/--- noreply@blizzard.com
12/10/13

to me
Greetings,

* * * NOTICE OF ACCOUNT CLOSURE * * *

A user of this account has recently been involved in actions deemed inappropriate for Diablo III by the In-Game Support staff of Blizzard Entertainment. This decision was made after a thorough investigation of the situation as a whole. Though we are unable to discuss the outcomes of our investigations due to privacy concerns, rest assured that this incident has been looked into very thoroughly, and the appropriate actions have been taken on all involved accounts.

Account Action: Account Closure
Offense: Unapproved Third Party Software
A third party program is any file or program that is used in addition to the game to gain an unfair advantage. These programs may increase movement speed or teleport heroes from one place to another beyond what is allowed by game design. It also includes any programs that obtain information from the game that is not normally available to the regular player or that transmit or modify any of the game files.

Cheat Programs ("Hacks")

We take action against accounts using hacks when a hero on the account is identified using a hack program. Hacks provide benefits normally not achievable in the game. Such benefits may include: increased speed, teleportation, or running through walls.

Automation Programs ("Bots")

We take action against accounts using automation programs or bots when one or more heroes on the account are identified using a bot to achieve automation.

This Diablo III account has been closed by our staff based on a review of the account and all related policy violations, in accordance with the Terms of Use and our In-Game Policies (http://us.battle.net/support/en/article/300722). Note that any open bids or auctions at the time of the account’s closure have been cancelled. Your open bids will be refunded to your original method of payment. Please allow 5-10 days for processing depending on the availability of your financial institution. Any bids or auctions completed prior to the account’s closure will neither be refunded nor reversed.

Moving forward, this Diablo III account and any Heroes or items associated with the account are no longer accessible. The only way to continue playing Diablo III is to purchase a new license, or to attempt to recover access by appealing account closure. While closure overturns are very unlikely, we advise that customers pursuing an appeal hold off on purchasing a new Diablo III license until the appeal process has completed. If you add a new Diablo III license, a new account will overwrite your old, without any prior Heroes or items from the closed account.

Any disputes or questions concerning this account action can only be addressed by Account Administration. To learn more about how Account Administration is able to assist you, and how to contact them via online ticket, please visit us at http://us.battle.net/support/e.... We will be unable to investigate account actions over the phone - an online ticket is the only way to contact Account Administration.

We understand that these policies may seem harsh, but they are in place to ensure that every player is able to fully enjoy their time spent on Battle.net. Thank you in advance for respecting our position.

Regards,

Blizzard Entertainment
Diablo III Customer Support
http://battle.net/support

Re:Banned from Battlecraft

[Spiked_Three]

So, I looked a little more, maybe it had not been 3 years since I played - but the point remains.

What especially pisses me off about this whole deal is knowing that I have 3 CD keys for half-life. Why? Yeah, friggin banned before by VALVE as well.

They may have gotten better, but there was a time in Mr Newell's past where his company was as bad, if not worse, in banning people without just cause.

Re: Banned from Battlecraft

[Uberbah]

You do realize that Battle. Net and Steam are products from two different companies right?

You do realize that's a non sequitur if he bought the games through Steam and has had his other Steam purchases blocked, right?

Re: Banned from Battlecraft

[dave562]

Where did you get that? He mentions Battle.Net and a slew of Blizzard games. No where does he mention purchasing games through Steam. The only reference that comes close to Steam is his comment directed to Gabe Newell.

Re: Banned from Battlecraft

[DrGamez]

(someone has access to your account and got it banned)

Mr Three, I suggest that some, if not most of the ignorance in your post, are due to YOUR accounts being compromised because of lack of technical skill. Stop punishing us, by making us read your bad comment.

Re:Banned from Battlecraft

[Spiked_Three]

Oh, in case I forgot to mention it, informative person, double, make that triple fuck off

Re:Banned from Battlecraft

[Yosho]

Good news! Being banned due to cheating on Steam only blocks you from joining multiplayer games. You do not lose access to any of your library.

Or, I don't know, maybe you're just lying at this point while desperately trying to save face.

Re:Visiting a Site Isn't Cheating

[Somebody Is Using My]

Mind you, it's less checking if you visited a site and more if your computer accessed a proscribed host.

Many of the cheats VAC is checking for are not only sold, but protected by a form of DRM that checks an authorization server before they let you use the cheat. VAC is more often looking to see if your computer is connecting to the authorization server; e.g., they are more interested in seeing if you visit authorization.cheaters.com than forums.cheaters.com

Not that I think that is much better, and I imagine that - especially now that the method has become common knowledge - it will become far less effective. The hacks will probably start using some sort of commonly used proxy to redirect and obfuscate the authentication request; perhaps the next version of WallHack.exe will come bundled with a TOR client.

Of course, the best option would be to give customers a choice: play on sponsored, VAC protected servers - albeit at a cost to your privacy - or allow VAC to be turned off and play the game on player-hosted servers, where you may (or may not) encounter people using cheat tools.

They are non-www servers, so it would be special i

[Anonymous Coward]

They explain that these are non-www servers, so you can't visit them. They are used directly by the apps to find their license servers, it's not the servers where you can download the files.

And if you need to visit cheat sites for this, I would open them in some VM since these aren't the most trustworthy sites.

Not actual cheat websites being checked

[Pricetx]

One point that I don't think a lot of the commenters aren't getting, is that it isn't the actual "cheat websites" that are getting detected by this system, the system doesn't even check for them.

As Gabe explained, most cheating software uses DRM, similar to that of games themselves, which "phones home" to the cheat software publishers to ensure that all of the users of the software are actually paying for it. These "DRM servers" will have their own domain names, and it's these domain names which VAC is looking for. This is to avoid flagging people for simply having visited the cheat website.

It's also worth pointing out that this check is only triggered *AFTER* VAC has already detected that the player is cheating through other means, it can be thought of as a second factor of cheat authentication. This means that players can't get "tricked" into being VAC banned by having malicious javascript on a website causing their PC to perform DNS lookups on these blacklisted domains, as they won't even be checked by VAC unless the player is detected as cheating through other means.

That being said, there's always the possibility of false positives, and if you combine that with malicious javascript mention above, you could just be incredibly unlucky and accidentally get VAC banned.

Re:Expect an exodus?

[DocSavage64109]

An exodus of cheaters wouldn't be a bad thing. Note that the DNS scan is only after the software detects a cheat.

Better than nothing

[BlackPignouf]

I don't like the answer, but it could be worse, and it's nice the director answered honestly.

RTFA

[Grantbridge]

From the actual article: 1)This is no longer in operation, it was only running for a couple of weeks in the constant cat-and-mouse game with cheat developers 2)It was targeted at the DNS for DRM servers which cheat authors used to SELL cheats to PAYING customers. The system simply reported if the MD5 hash matched the DNS for the known cheat DRM servers, once the cheat had been detected during gameplay already. The DRM servers were not running a website.

Re:Misleading article... read the real post by Gab

[Cheburator-2]

You seem the only person to actually go and read that article.

I always feel like...

[Trace Bullet]

Gabe Newell's watching me~ http://www.youtube.com/watch?v...

Also cheating with single player is fine

[aepervius]

Despite that , you might get banned , because you visited and used a cheat for a single player, which will have the exact same symptom as cheating for , say, TF2 (primary and secondary DNS entries).

Re:Also cheating with single player is fine

[ravenlord_hun]

Barring a ridicolous lack of common sense, just why would you start your own VAC secure server if you intend to cheat anyway?

Why ban?

[MadCow42]

Why not just shuffle anyone detected cheating into a separate game room? If they're paying customers, then they can all cheat together, and everyone wins.

Re:Why ban?

[Anonymous Coward]

Why not just shuffle anyone detected cheating into a separate game room? If they're paying customers, then they can all cheat together, and everyone wins.

This is already the case with VAC bans. VAC'ing your server is optional, and if you're VAC banned you can still play the game with any single player options, and multiplayer on non-VAC servers. The option of having VAC on a server is left to the server administrator.

Re:Why ban?

[gIobaljustin]

Because cheating is wrong?

According to who? You? Some people don't care, so don't decide this for them. Bottom line is, server administrators should be allowed to decide what they want to put up with, not you.

From the sound of it, what he suggested should happen is exactly what already happens, anyway.

Why not just create a special steroid Olympics where the athletes are allowed steroid use?

I don't know. Why not?

There's a reason they don't design it that way in the first place.

How they designed it is irrelevant to how people want to use the application.

everyone loses.

Only individuals can decide that for themselves.

Re:Why ban?

[gIobaljustin]

Exactly what other people pointed out, yet this guy acted as if that's not the case.

With that said, I play a number of games (Doom, with the Zandronum source port) online where the software is open source, and there isn't much of a cheating problem. The community self-regulates and server admins (both of individual servers and master server admins) take care of the problem. They don't need shitty, invasive anti-cheat software.

Re:Why ban?

[ragethehotey]

Why not just shuffle anyone detected cheating into a separate game room? If they're paying customers, then they can all cheat together, and everyone wins.

because even having the perception that you would allow cheating causes casual players to flee and never spend another dime.

i understand that your suggestion would be ideal, but in practice drives customers away.

Re:Why ban?

[ninjacheeseburger]

If you get VAC banned you can still play on non VAC servers.

Re:Visiting a Site Isn't Cheating

[QuasiSteve]

The point is that these aren't sites you would normally visit out on the interwebs. It's a bit like saying "oh but what if I somehow stumbled upon udashdiasd.dashbduiqidasdjkasd.dasbdaskd.hdasuida.something.com?" when the only known vector for ever hitting up udashdiasd.dashbduiqidasdjkasd.dasbdaskd.hdasuida.something.com is through a piece of malware, and complaining that your anti-malware package threw up a red flag.

More specifically, your comment's subject:

"So basically it wasn't pulling DNS for the entire machine but only looking for that one particular phone home call the cheat did? So merely looking at a cheat site won't get you banned?" - ava_ati

"Correct." - GabeNewellBellevue

- http://www.reddit.com/r/gaming...

Add to that that this check only occurs if VAC has already detected something fishy going on. So even if you did deliberately hit up these DRM servers (for science / research / because you want to lower the SNR for VAC).. unless you're actually using the cheat, VAC doesn't much care.

At least, them's the claims.

Re:Exploitable?

[Ardyvee]

It should only trigger the dns check if VAC believes you are cheating.

VAC checked for the presence of these cheats. If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban.

Emphasis mine.

Re:Visiting a Site Isn't Cheating

[idontgno]

Mind you, it's less checking if you visited a site and more if your computer accessed a proscribed host.

The use of the emphasized phrase with a straight face is exactly what's wrong with this methodology.

It's the Internet. Sane societies don't have "proscribed hosts".

if you find it abusive, turn off VAC

[Anonymous Coward]

Just turn it off. Nobody is forcing you to use VAC, oh unless of course if you want to play with non-cheating players.

Re:if you find it abusive, turn off VAC

[ArbitraryName]

You can't "turn off" VAC.

Re:if you find it abusive, turn off VAC

[ravenlord_hun]

Sure you can. Just don't connect to VAC secured servers.

Re:if you find it abusive, turn off VAC

[sosume]

net stop dnsclient

SteamOS Hacking?

[tlhIngan]

Given the openness of SteamOS - I'm guessing the side effect would be to develop anti-VAC kernel modules to fool VAC into thinking everything's sane and good even if the user is cheating to heck and back (and unless VAC is using a kernel module, it's pretty hard to protect against it...).

I mean, should Valve/Steam pull this off in the future, it's trivially simple for something the user puts on SteamOS to hide the DNS resolver cache, to hide the cheat processes and fake the file hashes from any process...

Re:Exploitable?

[The MAZZTer]

The more important bit is that your PC needs to have contacted the cheat DRM server. The only way this should happen is if you have a cheat installed that is trying to contact it. It's not something you would try to do with a web browser without the cheat.

TOS? Doesn't apply here....

[King_TJ]

The scanning is done client-side, which means it's just an internal function of the software.

It isn't divulging any of your internet browsing or usage history. It's just combing the local cache for specific things, and is a process it doesn't even do in the first place unless a user is suspected of trying to abuse Valve's gaming environment by cheating.

If the TOS has to state an app is going to access your local DNS cache, then Windows operating systems are probably in violation themselves!

Re:Exploitable?

[OhPlz]

A DNS hit is a DNS hit. Whether cheat software or your browser initiates the name resolve, it will end up in the DNS cache. The only protection is what the parent said, it already has to suspect that the player is cheating. Makes me wonder why the dip in the DNS cache is even necessary. To me, it implies that they're afraid of false-positives.

Nothing new here - RAM/DISK scans are part of AC

[Rotten]

Anticheat software have been scanning memory forever.and when if scans memory it's obviously comparing data to a pattern to decide if tha'ts a cheat or not.

Not sure what's the difference between you mail account lying open on the background holding all your personal communications beeing scanned by punkbuster or vac, or the dns cache beeing scanned too.

Code caves, hooking, etc. I'm not sure if anticheat software can't beat online game cheaters.

fuck beta

[synapse7]

I trust valve, and fuck beta.

Re:Visiting a Site Isn't Cheating

[TheCarp]

While I agree in general, I am not sure this applies here, for 2 reasons:

1. This is not society in general, this is on hosts which are running games, which are protected by VAC. The user signed up, the user installed the game, the user invoked the game, the user was warned that the game uses VAC and cheaters would be banned.

2. Even after the user has invoked the VAC protected game, these checks for "proscribed hosts" are not done as a primary check, but, as a followup to confirm an association for which there was already evidence.

#2 is important. Just going to a cheat site doesn't make you a cheater. However, if you are suspected to be a cheater for other reasons, and it turns out you go to the site for the cheat you are suspected of, that is confirmation. That is good investigation. If you look for whoever went to a site and then use that to bias your cheat detection, that is a good old fashioned witch hunt.

Re:Neither does valve.

[gIobaljustin]

Or you, if they happen to falsely flag you as a cheater.

Re:Read links, no answer

[Luckyo]

It does send it back to the mothership. Otherwise mothership wouldn't know how to ban. The detail they're arguing on is that they're doing comparison against database on your machine rather than theirs.

Of course, absolutely nothing stops a NSA mole inserting a few appropriate cites into target's VAC to check for sexual interests in case they need blackmail material to forward to CIA that specific person for example. And Gabe will be none the wiser, like the google and facebook CEOs were about NSA having essentially direct indexed search access to all their user data on demand.

Denial of common sense attack

[WaffleMonster]

If you look in a DNS cache all you know is name request was made you don't have any evidence of what was done with that name.

Any web site you visit could cause entries for any DNS name it chooses to be loaded into the cache. It is not hard to imagine competing clans, those who dislike you or just want to create chaos operate a site which causes incriminating entries to be loaded into DNS caches.

I want to see Valve held criminally liable for rummaging thru computers and conducting investigations.

Re:Potential for a DoS to legit users

[synaptik]

No, it isn't. If you'd RTFA, you'd learn that the DNS check only happens as a confirmation safety step, once an active cheat has already been detected by Steam.

Re:Read links, no answer

[EvanED]

Not all games are VAC-protected, and not all VAC-protected games have every server VAC-protected (I think). For instance, you won't have VAC running for single-player games.

Re:Potential for a DoS to legit users

[fatboy]

This is /.

Of course I didn't RTFA ;)

No, it isn't. If you'd RTFA, you'd learn that the DNS check only happens as a confirmation safety step, once an active cheat has already been detected by Steam.

Re:Not good for their aspirations

[Sowelu]

Yeah, I can't see Linux players being allowed on any servers for some games. "No VAC on Linux" is a reasonable statement. VAC-only games (I think CoD?) will therefore never make it onto the platform. Can you imagine if only one operating system didn't have cheat detection? Why not wave a big flag around saying "If you want to cheat, run Linux"?

There's a lot of players who actively choose VAC games over non-VAC games, even with full information about these countermeasures, because they want to lower the chances that they are playing against a cheater. Saying "I run Linux but please let me play your game" is like saying "I'm not willing to take a drug test but please hire me". Some places might. Some places never will.

Re:Read links, no answer

[Sowelu]

VAC only runs when you are actively connected to a VAC-enabled server.

Re:Expect an exodus?

[scottbomb]

I don't cheat and nor do I tolerate software sticking its nose in business other than it's own and my DNS records are none of anyone's business,regardless of what they use it for.

Re:Expect an exodus?

[Yunzil]

No, there won't be an exodus. This is a non-issue and no one cares.

Re:Neither does valve.

[ravenlord_hun]

If something on your PC is calling home to some cheat-DRM address (not forum, not discussion board, not even a frikken' download site)... then you are probably not a false positive, though.

Funny

[viperidaenz]

1: Post image hosted on cheating server in a forum frequented by Value customers
2: Wait for them to all get banned.
3: ???

Re:Nothing new here - RAM/DISK scans are part of A

[viperidaenz]

Anticheat software only scans the memory of the process it runs in.
Other processes don't have access to the memory of others.

Re:Expect an exodus?

[ravenlord_hun]

If you hate software poking around your RAM, running processes etc, then you can already wave goodbye to multiplayer - almost every anti-cheat service is doing those now (and need to, given the arms race between cheat software and cheat detection).

Unless you don't mind rampant cheating, that is. But if that's indeed no biggie, then I wish you an enjoyable stay in wallhack-land.

No Steam for me now

[future assassin]

I was quite excited about the official Steam client for Linux and bought about a $100 worth of games when it came out. Cheating or not they no have right to scan for/look at anything outside of the Steam system ie Steam/game created files.

Yes I will not support Steam anymore as I have that power. $100+ lost but lesson learned.

Revise and extend

[ThatsNotPudding]

I really don't understand why sandboxing every app is not only not the default, but also

made a legal requirement, enforced by the FTC.

This.

[DarthVain]

I am a bit conflicted, I don't like the idea, but then again I also don't want to play against cheaters. At least I can respect that he laid it out on the table and was honest about it rather than the usual BS PR response that usually comes out for these sorts of things.

Re:Steam hooks directly into the firefox.exe proce

[sexconker]

You can test this by trying to delete firefox.exe on Windows and see the process that has a lock on it via Unlocker

Rename firefox.exe to FuckYouFatassNewell.exe . Enjoy.

Re:Neither does valve.

[gIobaljustin]

You have no idea how their software works, as it's proprietary. Furthermore, the fact that you used the word "probably" says it all. You can't have absolute faith in any software, and certainly not if you can't see the source.

Re:Neither does valve.

[ravenlord_hun]

You could subtitue 98% of Linux and 100% of Windows systems and say the same. You say source - but we both know that if we're paranoid, just looking at the supposed does little good. Any binary you download could have been made from an altered source. So, how many OSes did you compile yourself? Which binary do you trust, and why?

Re:Nothing new here - RAM/DISK scans are part of A

[Edgewize]

That hasn't been true pretty much ever. Back before Windows did privilege separation, anti-cheats scanned everything they could find; after the rise of UAC, PunkBuster and other anti-cheat systems added a prompt to permanently authorize their system-level service on the first run.

Re:They are non-www servers, so it would be specia

[arth1]

They explain that these are non-www servers, so you can't visit them.

You don't have to visit them. Doing a name resolution query willl put them on the list, whether there's anything to visit or not.

Did you know that antivirus software, for example, may do a name resolution query on the hosts and IP addresses listed in the Received headers in an e-mail? That puts entries in your DNS cache, without you visiting anything. How about web boards that allow embedded images? A user can put [IMG]http://some.malicious.site/[/IMG] in a post, and there does not have to be a web server on that address for your browser to look up the address, and the OS cache it.

There are so many ways that your DNS cache can be full of entries that you have no control over, that it should never be used for evidence of anything. And what Steam does here is using it as secondary evidence.

Never mind that Windows should never allow unprivileged processes to display the complete DNS cache in the first place.

Re:Neither does valve.

[gIobaljustin]

I consider the freedom to look at the source important in and of itself. And even if being able to look at the source doesn't stop 100% of all Bad Things, it's a hell of a lot better than dealing with binary blobs. Don't resort to the perfect solution fallacy.

Re:Neither does valve.

[ravenlord_hun]

Good for you. Me myself, I won't put that much more trust into the ability of looking at a source that's many thousands pages long and so utterly complicated it would take a team of experts to fully audit; also one that may or may not be the same software I wound up with. Theoretical possbilities I have no real means to use are that: theoretical possibilities.

If you are that paranoid, do what I do. Install a network filter at your endpoint and analyze your own traffic. That's the only way to be sure, unless the network filter/analyzer themselves are bugged. But that's a risk I'll live with.

(Now, I also value open source for some of its merits - long-term maintainabilitiy, the biggest among them. But that doesn't mean blind and exclusive faith, imho.)

Re:Neither does valve.

[gIobaljustin]

(Now, I also value open source for some of its merits - long-term maintainabilitiy, the biggest among them. But that doesn't mean blind and exclusive faith, imho.)

I don't have blind faith, as I even accepted that it doesn't provide 100% security at all. However, I'm definitely not going to make the situation worse with proprietary software, and as I said, being able to look at the source is more important to me.

Re:Reducing false positives [Re: Still abusive]

[gIobaljustin]

Both should be a reason. The existence of false positives (and, as we've seen time and time again, these systems are as far from perfect as you can get) is but one of many reasons to oppose this.

I like anti-cheat.

[Kaenneth]

I always used to get accused of hax on public servers; now they can tell I am actually that good.

Re: No Local Resolver

[DrGamez]

I know this is AC but holy christ you didn't even read the summary.

Your ignorance is making me angry so please allow me this: fuck you.

New Tactic for online games

[miroku000]

Convince your opponent to visit a web page that causes dns lookups of all the major cheating sites.

Please tell me I'm dreaming!

[wdhowellsr]

Please tell me the browser cache is screwing with me. Please tell me that my wife wants to have sex more often ( ok that isn't going to happen, I have a 12 and 15 year old) Do we really have Slashdot.org back?

"yes, im an invasive prick"

[nurb432]

Admitting it does not make it any less bad. Boycott. ( or brick thru the window )

Leapfrog

[Trogre]

I guess this whole punkbuster thing is a constant game of leapfrog, but I wonder how long until this is worked around by, say, a browser addon that maintains its own DNS caches for selected sites so the system DNS cache is never touched, or even more simply, cheaters publicize a few IP addresses to crack sites, bypassing DNS completely.

Thou shalt not obey!

[Zynder]

This isn't the government. It's a private service with terms that you must obey. If you don't like it don't use it.

There was a time here in the US when "those" people had to sit over there, and drink from that fountain while these "better" people got sit over here with a nicer chair and a cleaner fountain. Isn't it strange how these days that doesn't happen anymore? I guess enough of "those" people didn't like it so quit going to those establishments and they just withered away. Yay, capitalism! Oh wait, it didn't happen that way at all. The government had to make them stop being racist assholes. Just because some company says it has to be their way or the highway doesn't mean they are correct. They know this and that is why there still hasn't been a good definitive court case on the validity of ToS's. We all know they are one sided contracts and they don't want a precedent set.

Re:They are non-www servers, so it would be specia

[Windwraith]

Actually, yes, you don't have to visit them, but you have to be actively using the cheat, because the VAC method involves checking for DRM checks (phoning home for verification) for cheat programs (believe it, it's actually a thing). Looking online for cheats and all those FUDdy things people keeps spewing in the comments is not the point, the point is recognizing the DRM servers for the cheat tools, only sanely accessible when using the tool itself, I don't think anyone will stumble upon that host during daily browsing, no matter how many cheats they look at online.

And, damn, If you look around you can see this is true, such cheat programs exist and, yes, I also think that paying for a cheat program with DRM is incredibly stupid. I had a hard time believing it until I looked around and saw that people is stupid enough to pay to cheat in games, AND allowing DRM on them to boot!

The real news here is that some people is obsessed with winning random games to the point of using such services with perhaps more DRM than Steam itself... it's really sad when you think about it.

ipconfig /flushdns

[sgt scrub]

net stop dnscache

If you break the rules you get more scrutinized?

[rhyous]

If you break the rules you get more scrutinized?

Wow! That isn't far. (Dripping with sarcasm) The world doesn't work that way! I am shocked and appalled.

[sourcode]
If (YouAreACheater()) CheckForMoreEvidenceOfYourCheating();
[/sourcecode]

Move along.

Nothing new to see here and nothing than really violates your rights or privacy.

Re:A far better way than Lumpy the wannabe's

[Anonymous Coward]

You are such a fun little loser. How cute that you are so unable to do anything but try to bother him. All you are doing is proving to everyone that you cant code crap.

Re:So cheating on a single player game could get y

[Anubis IV]

Based on what others are saying, it's just multiplayer mode in multiplayer games, and even then, only those where you're playing on a VAC-enabled server.

Security exploit

[Hypotensive]

It seems there is a security exploit here, and it is being performed by Valve. Windows (1) keeps an unencrypted cache of DNS lookups and (2) allows unfettered access to it from any application. This is pretty bad, but clearly it was not the intent when creating the cache to let random applications spy on your browsing history, so Valve's access to the cache has to be considered an exploit, possibly even a crime?

Nonetheless the take home message here is that better operating systems need to be designed that don't allow applications to access each other's memory and log files by default.

Cheaters never prosper (well, maybe they do)

[FreedomFirstThenPeac]

Seems to me that you can either play fair games with friends or play unfair games with cheaters. Auto-aim bots make FPS games no fun at all if you are playing against a random set of players. But giving up your browser history to get a fair game? Ought to be offered as an Opt-In and be done with it.