Live data from Hacker News

Are We Anti-Cheat Yet?

areweanticheatyet.com

161–170 of 197 posts

Re: Are We Anti-Cheat Yet?

#161

Earlier quoted context omitted.

And how's that gonna help you when cheaters can use an HDMI grabber and USB HID emulation? Lol

I imagine that having to buy special hardware means fewer people will do it, the types of dongles used for this are likely detectable in some way by kernel-level anticheat, and computer vision based cheats probably work better when you can inject contrasting color textures into the game. I don’t think any system will stop someone truly dedicated, but the general idea is that each thing that adds a little more frictio…

People buy dma cards and displayport/hdmi mergers to avoid hack detection. Another pc reads memory of your gaming machine through the dma card that creates your ESP overlay and then dp/hdmi is merged through a box. The dma card runs custom firmware that pretends to be some benign peripheral like an usb or soundcard.

https://captaindma.com/shop/

There's also hardware aimbot/triggerbot that reads your video output then sends input to a device connected to your mouse.

Its not what your everyday cheater has in free to play games like cs or cod but there are games where it matters more if you're banned, and when cheat subscriptions can be $100-200 a month the hardware cost isn't much.

Re: Are We Anti-Cheat Yet?

#162
post #106

Earlier quoted context omitted.

> Already the case for userspace programs, due to virtual memory Userspace programs can read other userspace programs memory, it's part of the standard win32 api[0]. > Cheats today essentially are like drivers, they do not run as userspace programs. Hence, they can do literally anything on your computer. In terms of privileges, driver code runs at a level as privileged as the operating system. Hence the need for prog…

> The handle must have PROCESS_VM_READ access to the process. While the process still stays in user space, that's significantly different than "just being a user space program"

What stops a process from running OpenProcess with PROCESS_VM_READ on another process run by the same user in the same logon session?

Re: Are We Anti-Cheat Yet?

#163
post #146

Earlier quoted context omitted.

I think what's naive is to assume that statistical detection methods haven't been investigated at length by the anti-cheat companies. When a complete newcomer comes to a field and sees professionals not doing a simple thing, the right question isn't "why don't you just do this, duh", but "I thought this would work, why doesn't it?".

Newcomers definitely make naive assumptions, Chesterton's fence etc. I'm not a newcomer though, I've worked on both cheats and anti-cheats going back more than two decades. I know how the sausage is made and it's not pretty. The anti-cheat companies you talk about mostly sell a mass produced product that works very similarly to anti-virus software. Games embed the anti-cheat module and its cheat definitions get updat…

Picking out the statistical outliers are not that hard, but will this not have diminishing returns? As soon as the cheaters learns that being too obvious gets you banned they'll change up how they play. Eventually there wont be much difference between the really good players and cheaters, is some false positives okay here?

Many cheaters were already trying to not be obvious, most I've encountered playing various fps games are not the typical spinbot in csgo. Instead they might play with only wallhack, aimtrigger, or even no hack, and only turn on the big hacks halfway through a game if they're not winning or think someone on the other team is hacking as well. In some games they use bots to dunk their stats when not playing.

AI detection is also coming to videogames with anybrain.gg, but seems like these can be countered with AI enhanced cheats no?

As an experienced player with an anti cheat/cheating/security interest it doesn't seem like statistics is the silver bullet you claim it to be, at least as your only detection/protection. It combined with normal protection/detection methods is likely what Riot is doing.

Re: Are We Anti-Cheat Yet?

#164

Earlier quoted context omitted.

Who do you think downloads and runs malware? Users.

By the same argument we should prevents the users from running any program at all because it might be malware.

No, but we shouldn't treat user's freedom as an anti-virus mechanism. Pretending that user acceptance will help in preventing malwares is extremely naive.

Re: Are We Anti-Cheat Yet?

#165

Earlier quoted context omitted.

And how's that gonna help you when cheaters can use an HDMI grabber and USB HID emulation? Lol

I imagine that having to buy special hardware means fewer people will do it, the types of dongles used for this are likely detectable in some way by kernel-level anticheat, and computer vision based cheats probably work better when you can inject contrasting color textures into the game. I don’t think any system will stop someone truly dedicated, but the general idea is that each thing that adds a little more frictio…

Trying to force ever more restrictive and intrusive controls upon players won't solve cheating. The only way to "solve" cheating is with https://xkcd.com/810/. Use statistical analysis and server-side controls (fog of war, lockstep calculations) to force cheaters to play indistinguishable from top human players. If you can't tell the difference, does it even matter?

> the types of dongles used for this are likely detectable in some way by kernel-level anticheat, and computer vision based cheats probably work better when you can inject contrasting color textures into the game

If you've ever worked in broadcast or volunteered for conference, lecture or house of worship broadcasting, you'll know there's an entire industry of cheap undetectable HDCP-removing HDMI splitters and capture cards. It's an open secret that conference AV relies on shitty $10 chinese HDMI splitters to make HDCP "work".

Similarly, there's a countless number of devices that can present themselves as any other USB device. You can MitM e.g. a keyboard or controller and inject packets that are impossible to distinguish from the users' own inputs.

Some consoles only allow wireless controllers with encrypted protocols, but that can be circumvented too. Replacing the joysticks in controllers with hall-effect ones is a common mod. It's possible to attach another chip inbetween at this point to inject custom inputs.

You can use these injected inputs to e.g. compensate for recoil. But you can also run a simple classifier on the HDMI video to identify objects and players.

Now sure, an anti-cheat could use statistical analysis to measure how quickly a player reacts, which would allow detecting such cheats. At this point it won't matter whether you're using kernel, userland or server-side anticheat though, as they've all got the same information available to them.

Re: Are We Anti-Cheat Yet?

#166
post #87

Earlier quoted context omitted.

It could if the hardware allowed such separation, but the x86 platform doesn't do anything close to that and allows reading memory of other processes in so many different ways in both userspace and kernel. Not to forget hardware being able to read memory via DMA that many use now.

- Have a thin hypervisor kernel - Have the user-facing OS be a VM managed by that hypervisor - Have the game process run under a second sibling VM The hypervisor can then mediate hardware access and guarantee nothing from VM A can access VM B nor the other way around. IIRC WSL2 enables such a mode, both the Windows OS the user sees and the Linux VM run under Hyper-V as siblings VMs. And Xbox One and up do EXACTLY the…

Without hardware support, once the attacker gets to the hypervisor, you can't trust the hypervisor, or the "guarantees" that such tainted hypervisor provides to be upheld.

You need hardware support for confidential computing (for example, AMD SEV) to be able to trust that the hypervisor can't just read/write all over the VM RAM.

Re: Are We Anti-Cheat Yet?

#167

Earlier quoted context omitted.

Yes. But, in practice, it usually doesn't result in any new cheaters. There is a myriad of reasons for this, but I won't go over them here.

Could I persuade you to reconsider going over them? I'm not expecting an essay or anything but it would be interesting. One thing that comes to mind for me is that most cheaters probably don't code the cheats themselves but buy them off telegram channels or whatever (just a guess), and probably wouldn't want to install a whole operating system for them

As Starz0r said, one of the main reasons is that the market is just very small. I think it was CSGO that had basically no protection on Linux for years, and the developers just ignored it because the small number of players didn't make much of an impact.

Re: Are We Anti-Cheat Yet?

#168

Earlier quoted context omitted.

I imagine that having to buy special hardware means fewer people will do it, the types of dongles used for this are likely detectable in some way by kernel-level anticheat, and computer vision based cheats probably work better when you can inject contrasting color textures into the game. I don’t think any system will stop someone truly dedicated, but the general idea is that each thing that adds a little more frictio…

People buy all kinds of stuff online, why not this device? Unless the game uses HDCP the hdmi rip is not possible to detect. And the usb controller could even forward the properties of the connected device. These devices exist as we speak

I think just purely off of the additional effort—a cheat that requires a second PC and specialized hardware is simply going to have fewer users than something you can download and run. Some portion of people won't care enough or will have some sort of other issue with the hardware setup. I think generally these things aren't about making it impossible so much as reducing the frequency.

Re: Are We Anti-Cheat Yet?

#169

Earlier quoted context omitted.

I imagine that having to buy special hardware means fewer people will do it, the types of dongles used for this are likely detectable in some way by kernel-level anticheat, and computer vision based cheats probably work better when you can inject contrasting color textures into the game. I don’t think any system will stop someone truly dedicated, but the general idea is that each thing that adds a little more frictio…

People buy dma cards and displayport/hdmi mergers to avoid hack detection. Another pc reads memory of your gaming machine through the dma card that creates your ESP overlay and then dp/hdmi is merged through a box. The dma card runs custom firmware that pretends to be some benign peripheral like an usb or soundcard. https://captaindma.com/shop/ There's also hardware aimbot/triggerbot that reads your video output then…

To my understanding, many of these devices are detectable by anticheat: https://www.reddit.com/r/Csgohacks/comments/19dbut1/dma_chea...

Anything that's plugged into the machine can be poked, prodded, and logged to a central database by anticheat software.

Re: Are We Anti-Cheat Yet?

#170

Earlier quoted context omitted.

Anti cheat is DRM. It's added specifically to make it so modifications are DRM circumvention and therefore copyright infringement. This isnt to protect the player, but forced by big suit investors to "protect their investment". The best anti cheat is proper net code. Games rarely do this because it's expensive and difficult. Consumers will buy it anyways. Anti cheat overtop is like calling an open window with a loud…

What's this magic netcode that stops aimbotting?

It does not, I assume the writer had some other game type in mind.

I presume it's also your point, netcode is irrelevant when the cheat is manipulating inputs.

Post reply on HN