Live data from Hacker News

Are We Anti-Cheat Yet?

areweanticheatyet.com

191–197 of 197 posts

Re: Are We Anti-Cheat Yet?

#191
post #146

Earlier quoted context omitted.

Newcomers definitely make naive assumptions, Chesterton's fence etc. I'm not a newcomer though, I've worked on both cheats and anti-cheats going back more than two decades. I know how the sausage is made and it's not pretty. The anti-cheat companies you talk about mostly sell a mass produced product that works very similarly to anti-virus software. Games embed the anti-cheat module and its cheat definitions get updat…

Picking out the statistical outliers are not that hard, but will this not have diminishing returns? As soon as the cheaters learns that being too obvious gets you banned they'll change up how they play. Eventually there wont be much difference between the really good players and cheaters, is some false positives okay here? Many cheaters were already trying to not be obvious, most I've encountered playing various fps…

It's definitely a cat and mouse game and no single method, including statistical analysis, is a silver bullet.

I'm definitely not advocating for doing less to counter cheaters. I'm just talking about how more could be done. As in, continue with existing methods and add new ones.

Also, yeah many cheaters would start being more conservative and manage to evade detection. However that is also a win. It's the aggressive obvious cheaters that are the worst, because it makes it obvious that the fight was unfair. If the cheater made it look plausibly legit, then the victim won't feel as bad.

Re: Are We Anti-Cheat Yet?

#192
post #87

Earlier quoted context omitted.

- Have a thin hypervisor kernel - Have the user-facing OS be a VM managed by that hypervisor - Have the game process run under a second sibling VM The hypervisor can then mediate hardware access and guarantee nothing from VM A can access VM B nor the other way around. IIRC WSL2 enables such a mode, both the Windows OS the user sees and the Linux VM run under Hyper-V as siblings VMs. And Xbox One and up do EXACTLY the…

Without hardware support, once the attacker gets to the hypervisor, you can't trust the hypervisor, or the "guarantees" that such tainted hypervisor provides to be upheld. You need hardware support for confidential computing (for example, AMD SEV) to be able to trust that the hypervisor can't just read/write all over the VM RAM.

Sure, security comes in layers. A trusted platform boot chain can validate the hypervisor much easily than a whole hard disk, and existing x86 instructions can do the rest. The attack surface is also quite a lot smaller. It's already miles better than unfettered access from the very same OS and anticheats being privacy-invasive rootkits.

Hardware support for confidential computing is cherry on the cake, but in this scenario the user is not trying to defend themselves against an attacker, the game is, from the user a.k.a the cheater.

Re: Are We Anti-Cheat Yet?

#193

Earlier quoted context omitted.

> At that point you're playing whack-a-mole, and you'll always lose. That's just sort of fundamental to society at some level though, we play whack a mole with all sorts of misbehavior until we reach some sort of acceptable equilibrium. I totally get the hacker mentality, I have a fully disassembled HP printer under my desk with some bullshit DRM that I've been desperate to break for some time, but I think your last…

> fully disassembled HP printer under my desk with some bullshit DRM that I've been desperate to break for some time With my brother printers it turned out I could just remove the chips from the genuine toner cartridges, reset the counters, and hot glue them to the refurbished toner. Maybe that works for HP ink as well?

This printer will simply refuse to print without an always-on connection to their cloud, it's diabolical. Thought I might be able to get root via its crappy web interface but no luck, and it seems to use properly implemented TLS when talking with the verification server, so I've taken it apart to poke at some interesting looking points on the PCB.

Re: Are We Anti-Cheat Yet?

#196

Earlier quoted context omitted.

I think there are external kvm like cheat devices though. Scans the image and controls the mouse and keyboard i guess

There are DMA (direct memory access) cheats, and that's discussed in the article (under the section "Hardware cheats make this all moot, no?"). Not sure about KVM-like hardware cheats, specifically. You could obviously use an AI to simulate mouse movements, but I don't think that's particularly common.

DMA cheats are not detected. What happened is thousands of cheaters all bought firmware from the same guy, and Riot was able to determine via stats that this group of people with the same obscure "network card" had outlier stats, and they banned them all. DMA is by definition not detectable, but human idiocy is.

Re: Are We Anti-Cheat Yet?

#197

Earlier quoted context omitted.

People buy dma cards and displayport/hdmi mergers to avoid hack detection. Another pc reads memory of your gaming machine through the dma card that creates your ESP overlay and then dp/hdmi is merged through a box. The dma card runs custom firmware that pretends to be some benign peripheral like an usb or soundcard. https://captaindma.com/shop/ There's also hardware aimbot/triggerbot that reads your video output then…

To my understanding, many of these devices are detectable by anticheat: https://www.reddit.com/r/Csgohacks/comments/19dbut1/dma_chea... Anything that's plugged into the machine can be poked, prodded, and logged to a central database by anticheat software.

DMA cheats are not detected. What happened is thousands of cheaters all bought firmware from the same guy, and Riot was able to determine via stats that this group of people with the same obscure "network card" had outlier stats, and they banned them all. DMA is by definition not detectable, but human idiocy is.
Post reply on HN