Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We outsmarted CSGO cheaters with IdentityLogger

mobeigi.com

Post reply on HN
Print view View original

81–90 of 372 posts

Re: We outsmarted CSGO cheaters with IdentityLogger

#81

Post by oneplane »

Night_Thastus wrote: post #63
oneplane wrote: post #51

Earlier quoted context omitted.

Some of the sophistication is not really in the technical breaking of the game or protocol anymore, figuring out if something is plausible might yield detections that you cannot "cheat" because it no longer matters if your cursor clicked on a head at the right time or not, it matters if your posture/reputation/experience makes your behaviour plausible. Cheating and anti-cheat used to rely a lot on the pure technical…

It's hard to balance around those sorts of things. For example, imagine a cheat that gives the player additional info about where enemies are and their state (ie: health). Even if they are of totally normal skill level in terms of movement and aim, that info will allow them to be substantially better than others. How are you going to detect that, and differentiate it from players who simply have a great sense of map…

Even the base example would make that specific scenario trivial: an account that is new has no business "being better" than everyone else.

The only group you'd punish with that is skilled players that lose their account (and create a new one), but if you use a moving skill window they can grow back into their plausibility pretty quickly, and it's a small cost compared to everything else. And you could even mitigate that by making things like the first 10 matches require a different plausibility score than the matches after that.

And with different I don't mean "no scoring at all" or something like that. But a cheater tends to not cheat "a little bit". You might have togglers, but that sticks out like a sore thumb (people don't suddenly lose or gain skill like that). And even if that fails (lots of "cheating a little bit" for example), you've still managed to boot out the obvious persistent cheating.

And that's just with 1 example and 1 scenario. Granted, that bypasses the fact that it is still difficult and doing it broader than one example/scenario is even more difficult, but that's why I ended the previous comment pointing out the difficulty and associated cost, which goes hand in hand with the balancing difficulty you pointed out. Even tribunal-assisted methods (not sure if Riot games still does that) have the same problem.

Re: We outsmarted CSGO cheaters with IdentityLogger

#82

Post by gosub100 »

snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

Just curious if IP bans work with IPv6 or if they are fundamentally incompatible?

Re: We outsmarted CSGO cheaters with IdentityLogger

#83

Post by drdaeman »

Ekaros wrote: post #49
colechristensen wrote: post #44

Earlier quoted context omitted.

This isn't the better question. When you have software running locally, you can arbitrarily modify how it runs. Like an aimbot is a powerful cheat, and there's no amount of security that can prevent one from being used outside of an anticheat being able to look deep into what your system is doing, what it contains. The only way to prevent that kind of thing is to remove your control of your own computer.

And even then you could do aimbot with camera pointed on the screen and either faking a mouse or providing sensor sufficient data somehow to simulate movement... That is reach super human reaction times and accuracy...

I wish I'd live to see the time of true cyborgs who will exceed ordinary human capabilities in some regard.

Re: We outsmarted CSGO cheaters with IdentityLogger

#84

Post by kemitche »

bob1029 wrote: post #78
kemitche wrote: post #46

Earlier quoted context omitted.

At the time of the events in the blog, CS:GO was NOT free, and yet there were still cheaters that apparently had access to 80+ accounts.

Charging money and banning at the payment provider level can be quite effective. It isn't a perfect answer but it cuts out gigantic chunks of the problem space. I'll take a ~99% cheat-free experience over not having any improvement at all.

Agreed, but in this particular case the blog writer was running private servers, rather than being Valve. They had no control over payment processing etc.

Re: We outsmarted CSGO cheaters with IdentityLogger

#86

Post by maccard »

andrewia wrote: post #40
DJBunnies wrote: post #29

Earlier quoted context omitted.

I think a better question here is: why is game code so exploitable? A: laziness and cost. It just doesn’t matter the same way that baking code matters, I guess. So they toss on some cheap anti cheat instead of architecting it safely (expensively.)

I think that's a very naïve way of looking at game development. There are many reasons why games are exploitable besides lack of reasonable dev effort. - Almost all games are going to use a licensed or shared game engine. That means the softwsre architecture is already known to skilled cheat developers with reverse engineering skills. - Obfuscating the game will only go so far, as demonstrated by the mixed success of…

A couple of thoughts, but I largely agree with you.

> Obfuscating the game will only go so far, as demonstrated by the mixed success of Denuvo DRM.

Denuvo is for the most part DRM, rather than anticheat. It's goal is to stop people pirating the game during the launch window.

> The game will not be the most privileged process on the machine, while cheaters are glad to allow root/kernel access to cheats.

This ship has sailed. Modern Anticheat platforms are kernel level.

> TPMs cannot be trusted to secure games, as they are exploitable.

Disagree here - for the most part (XIM's being the notable exception) cheating is not a problem on console platforms.

> AI enabled cheats no longer need any internal access at all. They can simply monitor display output and automate user input to automate certain actions like perfect aim and perfect movement.

I don't think these are rampant, or even widespread yet. People joyfully claim that because cheats can be installed in hardware devices that there's no point in cheating, but the reality is the barrier to entry of these hyper advanced cheats _right now_ means that the mitigations that are currently in place are necessary and (somewhat) sufficient.

Re: We outsmarted CSGO cheaters with IdentityLogger

#88

Post by newZWhoDis »

kemitche wrote: post #52
Retr0id wrote: post #34

> Wonderful, we have found a way to silently persist a cookie for each player as they join the server. This violates GDPR, no? Edit: It sounds like this took place before GDPR was being enforced.

GDPR isn't a blanket ban on cookies. You don't require a cookie notice for strictly necessary cookies, which you have a "grounds of legitimate interest" for: https://commission.europa.eu/law/law-topic/data-protection/r... Fraud prevention is listed as an example of a "legitimate interest." So no, by my layman's interpretation, they would not have been bound by GDPR to notify the user of cookies or other fingerprintin…

GDPR is toothless eurotrash.

I saw a consent form that had 72 optional, 21 “legitimate interest” cookies.

GFB

Re: We outsmarted CSGO cheaters with IdentityLogger

#89

Post by codefined »

> I only shared the solution and technique with one other server operator I fully trusted based in the UK

I think that was us! We ended up combining it with other fingerprinting indicators, but the whole 'use VGUI' was a surprisingly effective way at handling this. I believe they removed the web browser in ~2018, which was disappointing. Being able to have custom skill trees / fun integrations with servers was really powerful!

Re: We outsmarted CSGO cheaters with IdentityLogger

#90

Post by ghxst »

lwansbrough wrote: post #31

I suppose different people are entitled to different opinions about fingerprinting, but I reckon it only takes working on a single project where this is a real issue for you to change your mind. We do behavioural analysis on top of various fingerprinting for bot detection - some people are trying really hard to ruin the internet! I suspect a sufficiently advanced server side behaviour analysis could do a pretty good…

Not at the expense of false positives, though. Sophisticated cheat developers and bot creators are skilled at exploiting that narrow margin of error where companies can't push detection further without compromising the experience for legitimate users and destroying their game or service.
Post reply on HN