Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

361–370 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#361
post #35

>We don’t share the state of other players if it doesn’t need to be shared, so we can avoid common cheats like “map hacks” (revealing all players on the map). >We let the server’s game simulation make the authoritative game decisions and generally don’t trust the information received from the client, which helps prevent common cheats like “god mode” and “disconnect hacks,” barring any overlooked exploits. >Our networ…

Back in the day (2010) there was a cheat for LoL to make instant short-range teleports without cooldown, so they went a long path...

Re: Riot Games Approach to Anti-Cheat

#362
post #178

Earlier quoted context omitted.

Or it might be deemed reasonable. E.g. you may not film public road in the Netherlands because of privacy, but you may film the patch that your car stands on it if there have been car fires in your neighbourhood in the past month and you are concerned about your car.

> you may not film public road in the Netherlands because of privacy So does this effectively make dash-cams illegal?

License plates contain personal data.

Re: Riot Games Approach to Anti-Cheat

#363

Earlier quoted context omitted.

Instead of using an IP address to identify cheaters the game could assign a unique random generated ID to players. Then they could ban that id without using IP. I think this scheme complies with the GDPR if you take care of not binding that ID with other user personal information.

If you can identify a physical person with a unique identifier, it is PII according to GDPR, I believe.

You can apply a one way function to an IP to obtain an ID and then maintain a database of bad IDs. For example you could compute this ID by the SHA256(IP + secret salt). Since way one function don't allow you to recover the IP, the ID is not PII. If you detect an IP which has bad ID the connecting ban that IP from the game. I think this respect the GDPR, you don't maintain a list of IPs or any other PII.

Re: Riot Games Approach to Anti-Cheat

#364

Earlier quoted context omitted.

I wouldn't take PUBG as a compelling example. Most of what they do is WTF IMHO. The game is famous for being laggy, buggy, crashy, and the servers down often. They also have a history of making very strange technilogical and features choices. There is a reason the hype has gone down quite a bit... Still sounds very wrong what they are doing though.

I'm not entirely sure how this works but I would think the developers of BattlEye decides and develops what it reacts to and not the PUBG developers? Why else would you use a third party solution?

Ha yes, that sounds likely indeed.

I see they are used in quite a few games as well : https://www.battleye.com/ (including PUBG's main rival).

Interesting. Maybe my disappointment in PUBG got me to be a bit more biased than I should :).

Re: Riot Games Approach to Anti-Cheat

#365

I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it wa…

> You have to disable all VMware services or PUBG will kick you randomly for using "unauthorized applications."

If any game dis this to me, I would be having a refund, through credit-card charge-back if necessary.

Unless of course it is made obvious up-front that the game will not work with certain common legitimate software, in which case I'd have not paid for it in the first place and would play something else instead.

> which uses BattlEye. It actually injects a kernel mode driver

Sounds like something I need to avoid. A game is a user-land program and has no business touching kernel-space (with the possible exception of direct communication with the graphics hardware for performance reasons, but in this decade that to me would be a huge code smell...)

Having said that: I've not bought much by way of games aside from a few small ones in Steam of HumbleBundle sales, other parts of life are just too busy for me to have the time ATM, and I've never really bothered with PvP/online gaming (when I play games I do so to escape the unwashed masses, not invite them into my living room!), so I might be so far from the target audience that my thoughts on the subject count for nothing.

Re: Riot Games Approach to Anti-Cheat

#366
post #343

I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it wa…

I've been out of gaming for some years but this reminds me of similar issues with PunkBuster. I'd spend hours pulling my hair out trying to figure out why I was being booted from games. The worst bit was, it didn't actually stop cheaters.

> The worst bit was, it didn't actually stop cheaters.

These things usually don't, unfortunately, at least not for any considerable length of time.

It is the age-old arms race scenario. There are small number of developers and an army of potential cheaters. The developers have to get it right 100% and the cheaters only have to get their part right once: once a viable method is found it can be reused by themselves or sold, or passed on gratis.

And cheaters can be very determined, either because success in the game world by any means gives them some real form of affirmation or in the case of "professionals" some form of profit.

Heck, for some working out how to cheat the system is the game!

Re: Riot Games Approach to Anti-Cheat

#367

I wonder if there's an optimization to be made about tolerating a minimum amount of cheating while being vociferous about the countermeasures? Along the same lines as "no such thing as bad publicity", having just enough cheating to piss off a few people and getting them to talk about it and the countermeasures seems like a great way to get free advertising and game engagement of players just curious to see who is che…

You won't find any companies with competitive online games that turn a blind eye to cheating. If you consider a game with a cheater as being ruined for the other players, a very small number of cheaters can ruin games for a large portion of the players. For a rough example of how the math works, let's say we have a game that is 5v5. If we have 100 players, 1 player cheating, and everyone plays once you end up with 9…

> You won't find any companies with competitive online games that turn a blind eye to cheating.

My experience is a little different: if I buy enough in game shizzle (be it free to play or games like WoW with a buildin store), I get away with murder.

> For a rough example of how the math works[...]

IMHO You are right about the math, but use the wrong parameters. Many game companies that accept additional currency actually allow their moneymakers to "bend the rules". No hard data, just my individual observations while using "tools" in different settings.

Re: Riot Games Approach to Anti-Cheat

#368

Earlier quoted context omitted.

I agree with everything you say. It's ironic because game companies themselves use virtual machines with obfuscated instruction sets in their games as a copy protection mechanism. It's pretty hard to feel any sympathy for them once hackers get around their pathetic countermeasures. To add to your post, here's an example of why game developers can't be trusted to run code in kernel mode: https://mobile.twitter.com/The…

What would be a better option?

GOG is doing just fine, including AAA titles as Witcher3. It's the only place I buy games from.

Re: Riot Games Approach to Anti-Cheat

#369
post #190

Earlier quoted context omitted.

Reason for downvote: you seem to have no clue about blockchain or cheater.dll whatsoever.

Blockchain is all I work on and you seem to not understand my suggestion. cheater.dll needs to be loaded in memory along with the game. Correct, right? If the original build of the game has already generated an encryption key that is stored on a server or a distributed ledger using your account, then tampering with the origonal build in memory will result in generating and invalod key thus changing the ledger or the…

> Blockchain is all I work on

Yeah I know a few more of those people and I don't understand how they're convincing innocent people that they need blockchain and that they should pay you money to implement 'the future'.

> If the original build of the game has already generated an encryption key

I'll take that to mean "if the server already generated a key, unique for each purchase, that is put in the game and also stored on the server."

> then tampering with the origonal build in memory will result in generating and invalod key

No, why? You never explained how you got from "distribute license key with game" to "invalid key when you modify the memory".

> thus changing the ledger or the stored key on the server

?!?!?! There are so many steps missing in your "explanation". Who says the game has internet? Who says the cheater didn't block the license servers? Who says the cheater didn't emulate what should have happened alongside his modified version and is submitting that to the server? Who says the cheater didn't cut out the licensing part altogether?

This is making zero sense so far.

> If this happens then it invalidates your build and the distributed ledger would need to updated, but since that is not allowed in this instance all ledgers would reject your change and flag the block and the account.

So... other game clients would see that your key is invalid, is that it? Not the licensing server hosted by the developers, but the other clients would be doing the blocking?

Alright, let's say it were so: there is a blockchain with all the license keys and your license key is computed as a hash of all your RAM memory contents. You submit this hash of your memory to other game clients when you communicate with them. Every network packet needs to contain this, or else they will refuse to process the packet at all. Other clients can look up valid keys in the blockchain.

Then firstly, you don't need a blockchain. What you're looking for is a relational databa -- scratch that, you need json -- oh wait, not even that. No, what you're really looking for is a plaintext file. What in the world does blockchain have to do with publishing valid license keys?!

Secondly, you have a huge list of valid license keys published, ready to be picked up by cheaters. Don't you think anyone is just going to look at that list, be it in blockchain format or in json or in plaintext, and replace their signature field with one of those keys?!

Thirdly, your RAM continuously changes. It's not as if you can play without getting a new signature a few million times per second, with each write operation to RAM. But let's say we only do it once per frame, so 60 times per second. Then you need to know what all the possible states are going to be... you know what, this is making zero sense. Tying some key computed from your game state to a license is nonsense.

I would think you're a troll but your messages seem just a little bit too long for it, it seems like too much effort... but I kinda do think you're a troll. The more I think about what you're saying, that's the only logical explanation.

Re: Riot Games Approach to Anti-Cheat

#370

I have mixed feelings about anti-cheat, especially in the last few years. A lot of them are getting rather intrusive. Take Player Unknown's Battlegrounds for instance, which uses BattlEye. It actually injects a kernel mode driver into Windows that spies on whatever else your system is doing and exfiltrates unknown data in the name of "guaranteeing a fair game experience." I didn't even realize that this is what it wa…

Also since games are owned by Companies there is literally nothing you can do for all the decisions they take. You just have to get on with it.
Post reply on HN