Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Game Hacking – Valve Anti-Cheat (VAC)

codeneverdies.github.io

Post reply on HN
Print view View original

21–30 of 167 posts

Re: Game Hacking – Valve Anti-Cheat (VAC)

#21

Post by rimunroe »

Back in 2000-2005 I was very active in a community centered around 20 or so modded Counter-Strike servers which I volunteered as an admin on. We were generally good about having at least one admin on each server at any given time to deal with cheaters. Occasionally someone wouldn’t be around though.

There was a period of time lasting about a month or two where a player with a name like BELT SANDER or ANGLE GRINDER or TABLE SAW hung around. They were pleasant and unremarkable, but they frequently used new Steam accounts and switched IPs.

This person definitely wasn’t supposed to be an admin, but if they were around when someone was cheating and no actual admins were there, they’d somehow elevate their own permissions and ban the offending player. We tried to figure out what was happening and to see if we could somehow stop them, but we never did manage it. They were somehow gaining rcon access to the host server. After a while we just shrugged our shoulders. They didn’t seem to be harming anything, other than our peace of mind about our security. Overall they were actually really helpful for stopping late night/early morning disruptions.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#22

Post by gruez »

rvnx wrote: post #17
snickerdoodle12 wrote: post #10

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely i…

>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha.

They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".

Re: Game Hacking – Valve Anti-Cheat (VAC)

#23

Post by andrecarini »

rvnx wrote: post #17
snickerdoodle12 wrote: post #10

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely i…

I'm really curious about this but searching for "Google Omaha" doesn't return anything related and the linked FOIA request is... just a request, which I assume anyone can write whatever they want in the request.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#24

Post by zeta0134 »

phoronixrly wrote: post #18
snickerdoodle12 wrote: post #10

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

The other day I mentioned that it's not OK for games to be proprietary software and/or use unethical software like DRM (which tbh anti-cheats are as well). I got accused that I wanted game developers to starve to death.

I'll chime in here as a game developer: my upcoming release will be an NES cartridge[0] and probably a Steam app. I'll be adding no DRM, because I generally trust that folks that weren't going to pay aren't going to be converted by its presence, and that honest folks want to support my work. Whether the storefronts I release on add their own is up to them, and frankly I don't care.

Separately though, anti-cheat is another ball of wax entirely, and I have extremely mixed feelings in this field. Generally I favor "cheat detection should be serverside, don't trust the client" from a general security perspective, but... I can totally see a valid case in there, somewhere, for more rigorous clientside checks. Somewhere along that line though is rootkits and malware, and... well, no, please tell me up front that you loaded your game engine with these things so I can save my money and purchase something else, thanks.

[0] Using a custom mapper, which will help initially to discourage low-effort bootlegs at the very least. It's open source though, and will not be too difficult to add to emulators, at which point the dumped ROM should play fine on them.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#25

Post by gruez »

andrecarini wrote: post #23
rvnx wrote: post #17

Earlier quoted context omitted.

It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely i…

I'm really curious about this but searching for "Google Omaha" doesn't return anything related and the linked FOIA request is... just a request, which I assume anyone can write whatever they want in the request.

The request itself isn't very damning either. It just make references to vaguely worded "partnerships", and apparently uses that to imply that Google is handing over data. Even if we take that at face value, it says nothing about OP's claim, which is that NSA can ask google to serve backdoored updates.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#26

Post by malwrar »

rimunroe wrote: post #21

Back in 2000-2005 I was very active in a community centered around 20 or so modded Counter-Strike servers which I volunteered as an admin on. We were generally good about having at least one admin on each server at any given time to deal with cheaters. Occasionally someone wouldn’t be around though. There was a period of time lasting about a month or two where a player with a name like BELT SANDER or ANGLE GRINDER or…

I used to write cheats for CSS & other Source games. Not sure if the original CS would have the same vuln, but iirc you used to be able to use an INetChannel::ReceiveFile function with path traversal to grab the server config. There were a few cool hacks around the file path filtering logic they added in my era that (combined with ::SendFile) enabled a fun period of arbitrary RCE on Source servers.

I knew one person who made a wormable payload for a game I won’t disclose which used that method. The methods are in engine.dll so it’s symmetric, clients would infect servers, which in turn infects more clients, etc. Around then was when I decided to start gaming from a VM lol.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#27

Post by the8472 »

gruez wrote: post #22
rvnx wrote: post #17

Earlier quoted context omitted.

It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely i…

>If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue upda…

For CAs that'd likely get them kicked out of browser trust stores if someone detects it. And if it becomes known that a corporation pushes government-malware updates then that corporation would lose trust too.

So playing that card means moving the entire planet into a lower-trust equilibrium where everyone has to defend against that. In a better-coordinated world the conclusion from that would be "let's not do that", alas on this Earth TLAs have shown that they're willing to burn the commons, forcing a response like RFC 7258.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#28

Post by AndriyKunitsyn »

altruios wrote: post #20
phoronixrly wrote: post #18

Earlier quoted context omitted.

The other day I mentioned that it's not OK for games to be proprietary software and/or use unethical software like DRM (which tbh anti-cheats are as well). I got accused that I wanted game developers to starve to death.

that's where you turn and say: well, the game developer executives however... In all seriousness, DRM/anti-cheats => rootkits/rats. Don't fall for it. Demand better.

Can't say for DRM, but there's much bigger demand to play a multiplayer action game without experiencing cheating than demand for a similar game that's not a rootkit. Cheaters are nasty. Devs make rootkit anti-cheats simply because there's no better alternative, not because they're evil.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#30

Post by SteveNuts »

garrettjoecox wrote: post #9

Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through wal…

I'll never understand what people actually get out of cheating in games. I'll admit I've tried it a few times just for giggles (way back in the Age of Empires II/MSN Gaming Zone days), but the novelty quickly wears off and then it's just not even fun anymore.

There must be some very interesting psychology behind this.

Post reply on HN