Ha obfuscation. The best way to get management off your ass to prevent hacking without actually preventing hacking.
Riot Games Approach to Anti-Cheat
341–350 of 412 posts
Re: Riot Games Approach to Anti-Cheat
#342Back when I worked in games we would detect cheaters and then shadow ban. Quarantine them by only matching them into games with other cheaters. You may still have to ban them from certain elements of your game, like player economies (auction house, etc). But the more legitimate their experience looks the better. The idea is that instead of fully banning them and triggering the next iteration of the arms race, you tra…
Did you consider the possibility of false positives? Even the most modern and well considered justice system runs into this issue. Or is this not possible when detecting video game cheaters?
[deleted]
Re: Riot Games Approach to Anti-Cheat
#343I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it wa…
I've been out of gaming for some years but this reminds me of similar issues with PunkBuster. I'd spend hours pulling my hair out trying to figure out why I was being booted from games. The worst bit was, it didn't actually stop cheaters.
Re: Riot Games Approach to Anti-Cheat
#344Earlier quoted context omitted.
and how do you propose a server in Australia is going to achieve 10ms to a server in the US? Why is the server to server latency going to be less than the ISP's natural routes?
Streaming services have more money than consumers. Replace 10ms with whatever is possible. At some point, the latency will be lower overall.
For real-time "twitch" shooters, gamers will never accept it as a solution. You can't beat the speed of light traveling across earth.
Re: Riot Games Approach to Anti-Cheat
#345Some of this is pure evil. > We block this very common technique by making sure that when the value is changed by taking damage, the value is actually moved as well. > To introduce more entropy, we also made sure that each value uses slightly different encryption. > At compile time, a randomly selected type of anti-debug check is inserted into each of the locations where a check was requested in the code. Ive always…
it doesn't matter where you store the key as long as it's not easy to figure out for the disassembly program
If its out in the open it sort of defeats the purpose doesn't it? If you know the key + encryption scheme you could decrypt all the .text in a single pass.
Re: Riot Games Approach to Anti-Cheat
#346I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it wa…
I agree with everything you say. It's ironic because game companies themselves use virtual machines with obfuscated instruction sets in their games as a copy protection mechanism. It's pretty hard to feel any sympathy for them once hackers get around their pathetic countermeasures. To add to your post, here's an example of why game developers can't be trusted to run code in kernel mode: https://mobile.twitter.com/The…
What would be a better option?
Re: Riot Games Approach to Anti-Cheat
#347Earlier quoted context omitted.
> I think you could make a pretty strong argument that it doesn't apply, as long as you take pains to ensure that you can't identify the person from the information. That would entirely defeat the purpose of an anti-cheat system. You have to have some sort of personally identifiable information attached to the data being sent in to the server, otherwise how are you going to ban the cheaters? Even IP addresses are per…
Instead of using an IP address to identify cheaters the game could assign a unique random generated ID to players. Then they could ban that id without using IP. I think this scheme complies with the GDPR if you take care of not binding that ID with other user personal information.
If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.
Re: Riot Games Approach to Anti-Cheat
#348So I'm not seeing anything particularly novel here. In fact, I think most AAA titles do most if not all of these things today. It really just boils down to understanding your title's threat model and mitigating the threats. I think the article missed an opportunity to talk about false positive rates, the workflow for users to get unbanned due to false positives (usually a very nasty process), performance, platform su…
Yeah, I remember seeing the anti-scanning measure in another game circa 2009. IAT hooks were hot then too. I wonder if they run a CRC on sections of the game code as well (also pretty trivial to defeat).
Re: Riot Games Approach to Anti-Cheat
#349Back when I worked in games we would detect cheaters and then shadow ban. Quarantine them by only matching them into games with other cheaters. You may still have to ban them from certain elements of your game, like player economies (auction house, etc). But the more legitimate their experience looks the better. The idea is that instead of fully banning them and triggering the next iteration of the arms race, you tra…
Matching cheaters to cheaters is brilliant and should be THE non-intrusive industry standard!
Re: Riot Games Approach to Anti-Cheat
#350Back when I worked in games we would detect cheaters and then shadow ban. Quarantine them by only matching them into games with other cheaters. You may still have to ban them from certain elements of your game, like player economies (auction house, etc). But the more legitimate their experience looks the better. The idea is that instead of fully banning them and triggering the next iteration of the arms race, you tra…
Matching cheaters to cheaters is brilliant and should be THE non-intrusive industry standard!
Like Ashley Madison.