Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We outsmarted CSGO cheaters with IdentityLogger

mobeigi.com

Post reply on HN
Print view View original

211–220 of 372 posts

Re: We outsmarted CSGO cheaters with IdentityLogger

#211

Post by klausa »

matheusmoreira wrote: post #209
snarfy wrote: post #108

Earlier quoted context omitted.

Yes, we have a whitelist ability also, but it is definitely a last resort. The game is mostly dead and difficult to discover for new players. We don't want that roadblock if we can avoid it.

Small number of players works in favor of a whitelist. People shouldn't be playing with randoms, they should be playing with friends. Game companies invade our privacy and destroy our computer freedom with ineffective malware tier rootkit solutions only to fail to solve the problem in the end. Their business model depends on enabling people to play with any random from anywhere in the world. They are forced to trust…

>People shouldn't be playing with randoms, they should be playing with trusted friends.

People should be able to play with whomever they wish.

Re: We outsmarted CSGO cheaters with IdentityLogger

#212

Post by anticrymactic »

snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

> The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans their folder structure of certain system folders.

No. VPN blocking is useless to stop malicious actors as most residential connections have DHCP and VPN subnets are added and removed somewhat frequently, it's not that hard to find a "undocumented" one. It also completely excluds anyone using a VPN for non-malicous purposes.

Scanning files and folders is just ridiculous, not only an incredible invasion of privacy, but also trivial to work around.

Re: We outsmarted CSGO cheaters with IdentityLogger

#213

Post by throwaway2037 »

ryandrake wrote: post #114
mouse_ wrote: post #77

Earlier quoted context omitted.

The tactic 4chan uses: Regular IPs can post freely VPN or mobile IPs (blacklisted) must pay for a key ($20/year) that allows posting from blacklisted IPs. Key is good for posting from one blacklisted IP, locked for 30 minutes, so users cannot share keys. That way, you can ban the user by their key, if their IP is public. It's not a perfect solution but it seems to be the best they've found for such a situation so far…

I mean, in this case it's 4chan so who cares, but I hope we are not very slowly moving towards a troubling world with lower classes of IPs and upper class IPs. IPs should be IPs should be IPs, it shouldn't matter whether it comes from an ISP, a mobile network, a VPN, or anything else, and we shouldn't attach some kind of IP caste to providers or countries. I think we really need Internet-wide IP randomization, where…

About your edit: I think you are overlooking the Realpolitik behind running a public forum. Admins are fighting a constant war against spammers and trolls. It doesn't sound fun to me. Yes, you are right, we now live in the era of "upper class" IPs now. A bit sad, but is there a reasonable alternative?

Re: We outsmarted CSGO cheaters with IdentityLogger

#214

Post by Giorgi »

Ekaros wrote: post #11
Giorgi wrote: post #3

Thinking about it, steam should force this on every game developer that has cheating problem (I am assuming mainly shooters), maybe implemented better fingerprinting way, giving developers options to hide cookies somewhere in folders of their choosing.

Risk there is that what ever id is generated tends to leak. So lot of cheaters will either tamper with it or circumvent it. So the game will continue and not actually be effective for very long.

Sure but that can be completely randomized, no? like keep changing folder where cookie gets hidden, or the ID generated.

Re: We outsmarted CSGO cheaters with IdentityLogger

#215

Post by matheusmoreira »

klausa wrote: post #211
matheusmoreira wrote: post #209

Earlier quoted context omitted.

Small number of players works in favor of a whitelist. People shouldn't be playing with randoms, they should be playing with friends. Game companies invade our privacy and destroy our computer freedom with ineffective malware tier rootkit solutions only to fail to solve the problem in the end. Their business model depends on enabling people to play with any random from anywhere in the world. They are forced to trust…

>People shouldn't be playing with randoms, they should be playing with trusted friends. People should be able to play with whomever they wish.

I presume "whomever they wish" means anyone who is not a cheater. In that case they need a whitelist. Because without one, every player is a potential cheater. Non-whitelist solutions don't match what I presume they want. They asked for NotCheater, server returned MaybeCheater.

Without a whitelist, it's only a matter of time before an actual cheater joins their server and ruins their fun.

Enumerating badness just doesn't work.

Re: We outsmarted CSGO cheaters with IdentityLogger

#216

Post by hansvm »

anticrymactic wrote: post #212
snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

> The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans their folder structure of certain system folders. No. VPN blocking is useless to stop malicious actors as most residential connections have DHCP and VPN subnets are added and removed somewhat frequently, it's not that hard to find a…

VPN blocking is a cheap mitigation that stops 95% of the problematic traffic without removing a meaningful number of legitimate users.

Yes it doesn't "solve" the problem, and yes it removes some legitimate users, but it's by no means useless. Given the tradeoffs involved I'm not at all surprised it's so common.

If you have a solution that's less invasive (e.g., some businesses can get away with not providing anything expensive till after a payment has cleared the normal fraud window, and many businesses don't have obscene levels of malicious traffic; in those cases you can just let bad traffic run rampant and ignore it till it's a problem) then that's probably better, but blocking VPNs or whole countries or whatever can be the difference between a successful business and bankruptcy.

Re: We outsmarted CSGO cheaters with IdentityLogger

#217

Post by Ekaros »

Giorgi wrote: post #214
Ekaros wrote: post #11

Earlier quoted context omitted.

Risk there is that what ever id is generated tends to leak. So lot of cheaters will either tamper with it or circumvent it. So the game will continue and not actually be effective for very long.

Sure but that can be completely randomized, no? like keep changing folder where cookie gets hidden, or the ID generated.

Problem is that you do not want random. You want it to be generated. It should be same say after you reinstall OS and the drivers and the game.

Idea really is that you can identify single device time after time. So even if there is slight change in anything like software that can be easily changed that is not good enough.

Not that fingerprints should lead straight to bans, but maybe at least heightened awareness.

Re: We outsmarted CSGO cheaters with IdentityLogger

#218

Post by lll-o-lll »

ultimafan wrote: post #76

Cheating in online games is a scourge and I really don't understand why people do it. It's one person selfishly getting a "win" at the expense of ~60 other people in that match having their time, pleasure, potentially money absolutely wasted. I think even more infuriating than blatant hacking is this epidemic of "micro cheating" for lack of a better way to put it that I've seen prevalent in some games that just boost…

> Cheating in online games is a scourge and I really don't understand why people do it. It's one person selfishly getting a "win" at the expense of ~60 other people in that match having their time, pleasure, potentially money absolutely wasted.

The article addresses this specifically and concisely. It starts with “I'm not being funny and I mean no disrespect.” and then becomes very Australian.

Re: We outsmarted CSGO cheaters with IdentityLogger

#219

Post by lloeki »

johnisgood wrote: post #124
snarfy wrote: post #25

For UT2004, you can ban by player GUID (a hash of the CD key) or IP. With the game abandoned by Epic, a number of key generators have cropped up, which makes GUID bans useless. IP bans only go so far with VPNs costing $2 these days. The main solutions we have today are IP ban + VPN blocking using a database of known VPN subnets and adding them all to the firewall, and a similar fingerprinting technique which scans th…

> IP bans only go so far with VPNs costing $2 these days. https://redman.xyz/doku.php/schachtmeister2 was made specifically against people using VPNs. It was made for Tremulous (ioquake3 fork) where people kept evading IP bans, but it can be used for any other games. It is not my project, but I know the author, and I could personally fork it and make it suitable for specific (or any) games if there is demand for it.…

> IP bans only go so far with VPNs

Even without this IP bans only go so far as they're both easily swapped (VPN offers, or rent a VPS to forward traffic, or even by design with an ISP handing out dynamic IPs on router reboot) AND overreaching:

- NAT: ban household / campus

- CGNAT: ban whole neighbourhood

- IPv6: ban whole /64 => whole household (because of SLAAC + random privacy addresses)

Re: We outsmarted CSGO cheaters with IdentityLogger

#220

Post by 0dayz »

Frotag wrote: post #169
leetbulb wrote: post #26

This isn't about stopping cheaters (cheat detection). This is about stopping repeat cheaters trying to ban evade. Detecting cheats, especially nowadays with hardware cheats (DMA, etc), is an entirely different ballgame. IMHO, one of the most effective way to stop ban evaders is to actually charge money for the game.

Banning by TPM also makes ban evasion pretty expensive. At which point the cheater has to either buy a new mobo or solder a new TPM chip onto their mobo (not always possible). Though I guess at some point a sloppy vendor will leak TPM keys and it'll be spoof-able.

I could be wrong but couldn't you just get a pcie card that is effective a tpm card?
Post reply on HN