Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

Post reply on HN
Print view View original

151–160 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#151

Post by gambiting »

AnthonyMouse wrote: post #147
gambiting wrote: post #92

Earlier quoted context omitted.

>>The actual cheater is still getting a signal that they've been detected, because they get banned. So....yes. But there are mitigating tactics around this, I really recommend looking into it because it's a fascinating topic. As the simplest thing - you don't ban cheaters the moment they are detected to not give off how you detected them. That's why Activision bans people in waves and all at once, even though they kn…

> Yes, which is why the aim is to have 0 legitimate players getting caught by this, obviously. You can't just say that though, you have to actually do that , which is apparently not what's happening.

The problem is obviously the same as in many other industries - how do you distinguish honest legitimate players who swear they haven't cheated from people who will say anything to get you to unban them. I don't work in that department personally, but I've seen reports shared internally where the player literally went to local news station to say how unfairly they are treated and how we banned him without any info or any reason and how it's affecting his mental health and his family and he basically made a huge stink around it, and then we pull up the ban report for his account and we clearly see a screenshot from his machine where he's running cheat engine with cheats for our game enabled. Some people will just lie through their teeth to get their way. So you have to rely on what you know with absolute certainty - you detected something that is absolutely indicative of cheating? You ban them. Anything else is a no no. At least where I used to work no one used any kind of algorithm for automatic bans, those were only used for manually reviewed cases where someone would actually watch a replay of your game before issuing a ban.

Does that mean the system is foolproof? No, of course not. But banning honest paying users is a huge risk to any business - so obviously no one wants to do that, every system like this errs on the side of caution by default for that reason alone.

And obvious disclaimer - I can only comment on my own experiences, I have no idea what every company out there is doing.

Re: Reverse engineering Call of Duty anti-cheat

#152

Post by AnthonyMouse »

hnick wrote: post #93
AnthonyMouse wrote: post #78

Earlier quoted context omitted.

> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…

The intent is usually to gather data then ban in waves. If a new tool comes out and you ban a couple of players the tool authors might figure out why and update it. Let it sit a while and you can get hundreds/thousands of players who get a message to rethink their choice to cheat. An additional benefit is that this can include multiple cheat programs and versions in one ban wave, so it may be harder to narrow down ex…

> An additional benefit is that this can include multiple cheat programs and versions in one ban wave, so it may be harder to narrow down exactly what the flaw was.

That seems like it could go the other way. There are five cheat programs that each have a dozen versions and now you know that everybody using program A and D got banned, the people using program C and E didn't, and the people using program B got banned but only if they were using version 1.2 or lower and not exclusively version 1.3 where they added a new anti-detection method that A and D don't use and C and E do. Now they know what to do.

Whereas if you ban them as soon as you can detect them, the people using program B get banned before version 1.3 is even out, they have to issue all of those refunds immediately and stop getting sales because their cheat stops working now instead of months from now, and then version 1.3 may not ever get released. Now all they know is that C and E are doing something the others weren't, but that could have been any of a dozen things so A and D don't know what to change.

Doing it that way also has another major problem: Suppose you do the ban wave. Do the people using the existing known detectable cheats now get to make new accounts and keep cheating? If you ban them again right away then the cheat makers get to keep making variants until that stops happening, but if you don't then the game is back to being full of cheaters the next day and the cheat makers are still making money selling the old detectable cheats to fund the development of undetectable ones.

Re: Reverse engineering Call of Duty anti-cheat

#153

Post by lostlogin »

solarkraft wrote: post #148
ryao wrote: post #121

Earlier quoted context omitted.

Could it be that Gabe Newell is a nice guy?

He does respond to minor inquiries frequently, but do remember that his company supports a gigantic predatory underage gambling market.

I’ve tried searching and found the below, is that the sort of thing you mean?

https://www.seattletimes.com/business/bellevue-game-maker-va...

Re: Reverse engineering Call of Duty anti-cheat

#154

Post by DiggyJohnson »

solarkraft wrote: post #148
ryao wrote: post #121

Earlier quoted context omitted.

Could it be that Gabe Newell is a nice guy?

He does respond to minor inquiries frequently, but do remember that his company supports a gigantic predatory underage gambling market.

You could say “support a virtual market with insufficient controls” and be more truthful and engender a more productive discussion. They’ve come down pretty heavily on the gambling side, no?

Re: Reverse engineering Call of Duty anti-cheat

#155

Post by bangaladore »

15155 wrote: post #118
CobrastanJorji wrote: post #47

Earlier quoted context omitted.

Sure, and that's why there's more and more "trusted" hardware to try and get computers to a place where their users cannot read and write to or from their own memory.

Good luck ensuring every PCIe device with DMA access is "trusted."

IOMMU defeats DMA attacks.

There is no reason for a GPU or network driver, or anything to have arbitrary physical memory access.

If a GPU needs space for a draw-calls, allocate it in the kernel and explicitly give permission to the GPU to access it.

Re: Reverse engineering Call of Duty anti-cheat

#156

Post by bangaladore »

phsau wrote: post #142
alkonaut wrote: post #91

Earlier quoted context omitted.

This is true, but what is "reading and writing to memory" here? The article outlines dozens of ways of doing that with various hooks etc. And how they try to avoid that. If I put a hardware connection to the memory (basically WIRES to my memory bus) then yes, it's very hard to detect. But that's also very hard and expensive to do...

It's cheaper and more accessible than ever to use DMA/hardware cheats from cheat vendors.

DMA cheats are only usable as many games aren't willing to pull-up their minimum requirements to play. IOMMU defeats DMA attacks. Secureboot (largely) solves pre-boot EFI related concerns.

Re: Reverse engineering Call of Duty anti-cheat

#157

Post by Levitating »

solarkraft wrote: post #148
ryao wrote: post #121

Earlier quoted context omitted.

Could it be that Gabe Newell is a nice guy?

He does respond to minor inquiries frequently, but do remember that his company supports a gigantic predatory underage gambling market.

> supports a gigantic predatory underage gambling market

Last year Valve updated their code of conduct and effectively banned gambling. They've also been known to send cease-and-desist orders to various CS:GO gambling sites.

So I wouldn't say that they support it, though for much time they weren't actively combating it either.

Re: Reverse engineering Call of Duty anti-cheat

#158

Post by nottorp »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

> Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS.

Is it because normal people are out of public competitive multiplayer so you're left with the cheaters and toxic hypercompetitives?

Personally I've quit when Starcraft 2 was new. Got tired of being called a stupid noob ... when I won.

Re: Reverse engineering Call of Duty anti-cheat

#159

Post by michaelt »

bob1029 wrote: post #105
alkonaut wrote: post #89

Earlier quoted context omitted.

Honestly I'd prefer it if games could permaban based on just heuristics and the EULA simply stated "tough luck, buy the game again". I'd happily pay for that, knowing my money is at least not going to some 2 year legal fight. I get that I might be the one accused of cheating next time. But if that risk is tiny and the cost when it happens is $50 or $100 it sounds a lot more attractive than the alternative. Also (obvi…

I think stat based bans are the ultimate solution for all the client side bullshit. If you use statistics, you will sometimes get it wrong, but in the other cases the cheaters are completely out of luck. You could offer the source code to your game willingly and it wouldn't help them very much. If the cost of a false positive is $50 for the gamer and the chance of it happening is rare, I think many would quickly unde…

> I think stat based bans are the ultimate solution for all the client side bullshit.

When I play basketball I keep getting stuck playing against 7'6" guys with an 83% free throw percentage which is statistically very unlikely.

Alas my arguments they should be banned on statistical grounds have fallen on deaf ears :)

Re: Reverse engineering Call of Duty anti-cheat

#160

Post by snet0 »

Hikikomori wrote: post #141
dsjoerg wrote: post #134

Earlier quoted context omitted.

Why do you think human admins are the only viable solution? Plenty of games thrive without them—e.g., Apex Legends uses robust reporting and anti-cheat systems, and Rocket League's moderation is largely automated yet effective.

Apex had plenty of cheaters when I played it, if there's a cheater and they're not detecting it there's not much I can do, just 20-30 minutes wasted. If its a server with admins I can contact them on discord and get them banned pretty quickly. As a system it worked pretty well, had some badmins but there was plenty of servers so could just join another. Though its not really compatible with the matchmaking style game…

I don't think you appreciate:

1. How many active Apex/whatever games there are at any one time 2. How many users will just report anyone they die to as a cheater

Post reply on HN