Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

101–110 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#101
IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play?

For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

Re: Riot Games Approach to Anti-Cheat

#102

I wonder, given that nowadays access to vast amounts of computing power on demand is easy, if it would be effective to generate unique builds for each and every player. Just like they already do, but tailored for each downloader. Which would get tied to an account, and to a given fingerprint.

you are talking about a blockchain.

I have talked about this in many occasions to developer and they also agree that a blockchain to maintain a unique fingerprint of the game is very good to deter many attacks to modding and extensions to code, no matter the platform.

Re: Riot Games Approach to Anti-Cheat

#103
post #8

Earlier quoted context omitted.

You obviously shouldn't rely entirely on security through obscurity, but obfuscation can absolutely be an important component of defense in depth. Especially when your attackers own the hardware.

Agreed. Definitely not trying to say encryption is a poor strategy. But it does seem obfuscation is most of their anti-cheat techniques. But the larger point I was trying to make is that all these studios are very secret about anti-cheat but they all seem to be fighting the same battle. Makes me wonder if the industry would be better off with cross-studio collaboration and open-sourcing anti-cheat libraries (that won…

> open-sourcing anti-cheat libraries (that won't be defeated by knowing the details).

This doesn't make any sense. Anti cheat rely on the fact that it's not known. There is no such a thing as open source in the anti cheat world. It's all very secret for a good reason.

Re: Riot Games Approach to Anti-Cheat

#104

I wonder if there's an optimization to be made about tolerating a minimum amount of cheating while being vociferous about the countermeasures? Along the same lines as "no such thing as bad publicity", having just enough cheating to piss off a few people and getting them to talk about it and the countermeasures seems like a great way to get free advertising and game engagement of players just curious to see who is che…

Blizzard is famous for a variation of this. They will spend a few weeks/months detecting cheaters, but do nothing. Then, they will ban many users of a given cheat at the same time. This creates press, which helps the message of "you will be banned if you cheat" spread further than if they had immediately banned each offender.

I'm not sure Blizzard does ban-waves for press. From what I've heard, they (and many other developers) ban in waves so it's harder for cheaters to establish causality. "I did this thing and got banned, therefore avoid doing this thing."

Re: Riot Games Approach to Anti-Cheat

#105

I wonder, given that nowadays access to vast amounts of computing power on demand is easy, if it would be effective to generate unique builds for each and every player. Just like they already do, but tailored for each downloader. Which would get tied to an account, and to a given fingerprint.

What problem would that solve?

If I tell you right now that every single digital dollar will need to include the finger print of the digital printing press that created it. How would you be able to forge a new one without that fingerprint? You can't because every time you alter the digital dollar you create a new fingerprint that does not match the original digital printing machine.

This fixes a lot of problems with altering code and and extensions and modding. Does not fix memory changes but it can make it quite difficult because each memory change would have to be validated against the original fingerprint already registered on the server for your particular build.

Re: Riot Games Approach to Anti-Cheat

#106

I wonder, given that nowadays access to vast amounts of computing power on demand is easy, if it would be effective to generate unique builds for each and every player. Just like they already do, but tailored for each downloader. Which would get tied to an account, and to a given fingerprint.

What problem would that solve?

I think he's implying a cheater's injected DDL would be tailored for a specific build, so if they shared it with others, it would be ineffective. And not only that, but based on how the Cheater.DDL is targeting the build, they could identify the account that made the cheat.

Re: Riot Games Approach to Anti-Cheat

#107

IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play? For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

APM was certainly an impressive stat that conveyed the level of athleticism required for e-sports.

Of course, you're right, if the goal is who can strategize the best then APM shouldn't be a factor.

The playing field needs to be level though. Perhaps something like Formula 1 or Le Mans racing will develop for e-sports where people are allowed to fine tune their input with custom code with certain regulations for those inputs.

Re: Riot Games Approach to Anti-Cheat

#108
post #95

Does it hinder Linux gamers who are using Wine? A lot of such anti-cheats can't figure out when Wine is used and ban Linux users. Some also ban custom D3D implementations like DXVK even if they are really correctly implementing the API.

Yes - it hit the news that LoL will no longer work on Wine or virtual machines because of these anti-cheat measures.

Re: Riot Games Approach to Anti-Cheat

#109
The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine code, or even random locations in the heap, all of which may or may not actually be verified on the other end.

You can use any number of obsfucation tricks to hide their purpose (if they even have one) and you could even randomly generate them. And since the server expects the response in the next client packet it would be literally impossible for a cheater to manually deconstruct them, and even be difficult for automatic analysis tools to have enough time to do anything meaningful with it.

You can reduce the security nightmare from the user's perspective by only allowing machine code that's on a tight whitelist. Allow it to read from anywhere, and only let it write to a dedicated little sandbox area with e.g. fixed addresses.

Re: Riot Games Approach to Anti-Cheat

#110

Earlier quoted context omitted.

You won't find any companies with competitive online games that turn a blind eye to cheating. If you consider a game with a cheater as being ruined for the other players, a very small number of cheaters can ruin games for a large portion of the players. For a rough example of how the math works, let's say we have a game that is 5v5. If we have 100 players, 1 player cheating, and everyone plays once you end up with 9…

I'm not suggesting they tolerate it completely. Just that they make the game slightly "cheatable" then counteract it enough for there to be a known controversy.

No one is intentionally making it possible to cheat in their games. Cheaters and cheat detection/prevention are in a constant arms race. You can't just allow a little cheating. The people that develop cheats will share them and those cheats become more widespread.

Your whole argument is also based on the idea that there is no such thing as bad publicity. This is incorrect. If your game gets a reputation for being full of cheaters then people will leave your game and probably not come back. If the first time you hear about a game, all you hear is that it is full of cheaters are you going to head out to the store to buy a copy?

Post reply on HN