Slashdot Mirror
Gabe Newell Responds: Yes, We're Looking For Cheaters Via DNS
dotarray writes "Valve has stepped up to answer allegations that the company's anti-cheat system was scanning users' internet history. Rather than a simple, sanitized press release or a refusal to comment on 'rumours and innuendo,' Valve CEO and gaming hero Gabe Newell has personally responded."
Newell or not, not everyone will like the answer. The short version is that Yes, Valve is scanning DNS caches, with a two-tiered approach intended to find cheating users by looking for cheat servers in their histories. Says Newell: "Less than a tenth of one percent of clients triggered this second check, accessing the DNS cache. 570 cheaters are being banned due to DNS searches."
Sorry Gabe, you're not allowed to see my DNS history. You aren't allowed to see GabeNewellNatiliePortmanHotGritsFanFiciton.net in my history. That's not allowed.
Is this search in the TOS, or is it an "unauthorized" search?
This issue is a bit more complicated than you think.
The biggest part of his announcement is that this checking is done client side; your DNS history is not sent to Valve. They also only record MD5 hashes that match the cheat sites they are looking for, not your entire DNS history. Finally, they claim to only check for DNS lookups of servers used by the cheat software itself, not just websites where you might read about and download cheats (although in some cases I imagine these could be the same), and use this as a second check after the client has already detected a cheat installed on you machine. So simply visiting cheat software websites without using them shouldn't get you banned.
I trust Valve more than the NSA.
The NSA doesn't protect me against hackers.
No need to check your DNS history to tell you haven't visited OhNowIGetTheJoke.net
This is why I don't like the idea that games seemed to have moved away from hosting your own server. Online games were great when you knew the guy you were playing against. There wasn't as many problems with cheating, or perhaps you could agree on which cheats could be used, and the in-game chat was a lot more tolerable. Now that you're just playing against a random selection of people from the internet, I just don't get as much enjoyment out of it.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
They did not look at DNS histories of your browsing... there are cheats that have their own DRM that phone home to the cheat server to make sure you paid for the cheat (/irony). All Valve was looking for was the phone home to the cheat servers, not your bloody porn searches, or even visiting a cheat website.
The more I see stories about various programs accessing all sorts of stuff they aren't supposed to, the more I wonder why we still allow this? I use my browser for something, there shouldn't be any other program on the computer that knows about it. It's time we eliminate this idea that every app has access to every file on our computers. I really don't understand why sandboxing every app is not only not the default, but also very rarely even available on most operating systems.
It seems these days most apps are hostile to the users, it's time we treated them as such and stopped letting them have the run of our computers.
VAC looks for the DRM servers that ensure you're a paying user of the cheat. Check the Reddit post.
It's not an issue of viewing cheating sites; Steam is looking for DNS lookups performed on DRM servers (not the Steam ones). Many cheats are paid-for so, in a cruel twist of fate some might say, they use DRM to check if the cheater has paid for the priviledge of doing so.
gaben himself has said that this tactic only lasted a matter of weeks anyway, until the cheatware started futzing around with the player's DNS cache to avoid these checks.
If God forks the Universe every time you roll a die, he'd better have a damned good memory.
They explain that these are non-www servers, so you can't visit them. They are used directly by the apps to find their license servers, it's not the servers where you can download the files.
And if you need to visit cheat sites for this, I would open them in some VM since these aren't the most trustworthy sites.
One point that I don't think a lot of the commenters aren't getting, is that it isn't the actual "cheat websites" that are getting detected by this system, the system doesn't even check for them.
As Gabe explained, most cheating software uses DRM, similar to that of games themselves, which "phones home" to the cheat software publishers to ensure that all of the users of the software are actually paying for it. These "DRM servers" will have their own domain names, and it's these domain names which VAC is looking for. This is to avoid flagging people for simply having visited the cheat website.
It's also worth pointing out that this check is only triggered *AFTER* VAC has already detected that the player is cheating through other means, it can be thought of as a second factor of cheat authentication. This means that players can't get "tricked" into being VAC banned by having malicious javascript on a website causing their PC to perform DNS lookups on these blacklisted domains, as they won't even be checked by VAC unless the player is detected as cheating through other means.
That being said, there's always the possibility of false positives, and if you combine that with malicious javascript mention above, you could just be incredibly unlucky and accidentally get VAC banned.
I don't like the answer, but it could be worse, and it's nice the director answered honestly.
From the actual article: 1)This is no longer in operation, it was only running for a couple of weeks in the constant cat-and-mouse game with cheat developers 2)It was targeted at the DNS for DRM servers which cheat authors used to SELL cheats to PAYING customers. The system simply reported if the MD5 hash matched the DNS for the known cheat DRM servers, once the cheat had been detected during gameplay already. The DRM servers were not running a website.
Why not just shuffle anyone detected cheating into a separate game room? If they're paying customers, then they can all cheat together, and everyone wins.
I used to have a sig, but I set it free and it never came back.
I don't think Mr Newell has anything to do with Battle.net so I'm not sure what you're complaining to him about it for. Have any examples of false positives in VAC games?
Please go on. Tell us how Mr. Newell's lack of technical skill has anything to do with "Battlecraft."
By the way, you should at least learn the name of the service you're complaining about before you continue to make yourself look like a complete moron.
(Hint: It's Battle.net, and it has nothing to do with Valve or Steam)
Karma: Terrifying (mostly affected by atrocities you've committed)
Like you I imagine, I've been playing online games for a long time. I even ran a half dozen TFC / Natural Selection / CounterStrike / Half-Life Deathmatch / etc. servers for three or four years. I never found cheating to be common except for CounterStrike. For some reason that game attracted cheaters like crazy. The other games, not so much. Cheating wasn't just uncommon - it was rare.
When PunkBuster and similar products became popular it was amazing how much better I became compared to other players when playing on a protected server. (o:
VAC has, in my opinion, done a very good job overall of keeping up with the cheating crowd. I can't remember the last time I came across a player that I suspected of cheating - and having had to do detection manually by watching player behavior, I'm very confident in this.
There's a few things you can look for manually when looking for cheaters.
Your typical aimbot is easy to detect. Jump into spectator mode or whatever and pick the first person view for the selected player. Instead of the smooth movements a typical player will have, you'll see the player's aim snap to positions on a screen. It's rare to see these anymore because detection is so incredibly easy.
Driver hacks to provide see-through textures, or model hacks that have a long cross through them that extend through walls, are also pretty easy to detect by watching the player. Is someone across the map and scoring head shots through walls? Does he always seem to know where the enemy is? He's using one of these.
The interesting cheat is the second one (wall / model hacks) which allows one to see opponents behind objects, because it's not a mechanical advantage like an aim bot; it's a strategic advantage, an information advantage. It doesn't change the ability of the cheater to aim more accurately; it changes the cheater's behavior. A player without the cheat information will act as if the opponent is not there; a player with the information will.
So, you'll see tactical advances / retreats, shots fired / grenades thrown, etc. that would not occur in normal non-cheating game play. Yes; there will always be the person who gets the lucky what-the-hell shot. That happens.Sometimes more than once. What you need to look for is a consistent pattern over time that cannot be attributed to simply being "good", having a better overall strategy, or having an unusual play style.
I bet that with enough information collected it would be possible to detect this kind of behavior and flag individual players for follow-up manual inspection. It would be a fascinating bit of research, really.
Resource hacks are very dead these days, as information about resources (ammunition carried, money earned, life amount, etc.) are all stored server-side for most games. There's no way for the client to fiddle with that data.
Love sees no species.
The scanning is done client-side, which means it's just an internal function of the software.
It isn't divulging any of your internet browsing or usage history. It's just combing the local cache for specific things, and is a process it doesn't even do in the first place unless a user is suspected of trying to abuse Valve's gaming environment by cheating.
If the TOS has to state an app is going to access your local DNS cache, then Windows operating systems are probably in violation themselves!
When I was in college, my friend had a roommate who played CS nearly all the time. His roommate actually failed out of college because all he did was CS.
While I think most of your points stand, I can say with 100% certainty that he acted like he could see through walls. He was so good that he routinely killed people (with headshots, even) through walls. Had I not seen his monitor with my own eyes, I would have known he was cheating. He was frequently accused of cheating. In fact, he could only play on his clan's server because he'd get banned nearly everywhere else. He'd routinely go 51/2 K/D in a match. Sometimes when we played with him, we would all have to reassure people that he wasn't cheating by vouching for him.
Just something to think about before anyone accuses a really elite play of hacking. What they can accomplish is rather insane.
-=Lothsahn=-
1: Post image hosted on cheating server in a forum frequented by Value customers
2: Wait for them to all get banned.
3: ???
Actually, yes, you don't have to visit them, but you have to be actively using the cheat, because the VAC method involves checking for DRM checks (phoning home for verification) for cheat programs (believe it, it's actually a thing). Looking online for cheats and all those FUDdy things people keeps spewing in the comments is not the point, the point is recognizing the DRM servers for the cheat tools, only sanely accessible when using the tool itself, I don't think anyone will stumble upon that host during daily browsing, no matter how many cheats they look at online.
And, damn, If you look around you can see this is true, such cheat programs exist and, yes, I also think that paying for a cheat program with DRM is incredibly stupid. I had a hard time believing it until I looked around and saw that people is stupid enough to pay to cheat in games, AND allowing DRM on them to boot!
The real news here is that some people is obsessed with winning random games to the point of using such services with perhaps more DRM than Steam itself... it's really sad when you think about it.