Riot Games Approach to Anti-Cheat • Hacker News Board

Re: Riot Games Approach to Anti-Cheat

#51

Post by seanalltogether » Tue, Jul 17, 2018, 7:35 PM UTC

rjvbk wrote: post #35

>We don’t share the state of other players if it doesn’t need to be shared, so we can avoid common cheats like “map hacks” (revealing all players on the map). >We let the server’s game simulation make the authoritative game decisions and generally don’t trust the information received from the client, which helps prevent common cheats like “god mode” and “disconnect hacks,” barring any overlooked exploits. >Our networ…

It might seem obvious, but a lot of current PvP game engines still maintain global state of all players on the map and trust position info sent from the game client to all other clients. This has been the status quo going all the way back to the beginning of online gaming.

Re: Riot Games Approach to Anti-Cheat

#52

Post by sthomas1618 » Tue, Jul 17, 2018, 7:36 PM UTC

def_true_false wrote: post #12

monocasa wrote: post #8

Earlier quoted context omitted.

You obviously shouldn't rely entirely on security through obscurity, but obfuscation can absolutely be an important component of defense in depth. Especially when your attackers own the hardware.

Or you could design the game mechanics so that client-side cheating offers little advantage... but that would probably require doing more than ripping off a popular mod of another game.

Aside from strategy/RTS games, I'm not sure if thats even possible? How does is ripping off a popular mod relevant here?

Re: Riot Games Approach to Anti-Cheat

#53

Post by madjam002 » Tue, Jul 17, 2018, 7:36 PM UTC

pythonaut_16 wrote: post #17

I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality. As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where d…

Reminds me of my childhood playing ROBLOX on various Script Builder games where users on the server could script with Lua. It was basically a race to who could script admin commands and completely own the server.

Re: Riot Games Approach to Anti-Cheat

#54

Post by noxToken » Tue, Jul 17, 2018, 7:36 PM UTC

rjvbk wrote: post #35

>We don’t share the state of other players if it doesn’t need to be shared, so we can avoid common cheats like “map hacks” (revealing all players on the map). >We let the server’s game simulation make the authoritative game decisions and generally don’t trust the information received from the client, which helps prevent common cheats like “god mode” and “disconnect hacks,” barring any overlooked exploits. >Our networ…

Riot's engineering blog is typically aimed at developers and engineers of all skill levels. They try to make all of their topics approachable. If you're a seasoned veteran, you probably won't get a lot of technical insight from these posts.

Re: Riot Games Approach to Anti-Cheat

#55

Post by w-m » Tue, Jul 17, 2018, 7:36 PM UTC

pythonaut_16 wrote: post #17

I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality. As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where d…

There was some excitement for Notch's 0x10c for a while, an open universe space game where you would have been able to program your ship's computer. But according to wiki:

> The game was eventually indefinitely postponed because Persson found several creative blocks, citing the main problem as "it not being very fun to play".

Re: Riot Games Approach to Anti-Cheat

#56

Post by def_true_false » Tue, Jul 17, 2018, 7:38 PM UTC

Sohcahtoa82 wrote: post #27

def_true_false wrote: post #12

Earlier quoted context omitted.

Or you could design the game mechanics so that client-side cheating offers little advantage... but that would probably require doing more than ripping off a popular mod of another game.

> Or you could design the game mechanics so that client-side cheating offers little advantage Not possible in any sort of real-time game that involves reacting quickly to what your opponent does, or a game where user input precision is paramount. I mean, that idea basically eliminates all first-person shooters, where aimbots run rampant.

> I mean, that idea basically eliminates all first-person shooters, where aimbots run rampant.

Indeed, mechanics that reward mechanical skill are more susceptible to abuse.

From the article:

> For example, some common techniques we see include helping players dodge skillshots, zoom out farther than they normally could, or perform perfectly executed combos to smash their opponents’ faces.

Scripting perfect combos can be mitigated by introducing more delay (i.e. backswing after using abilities/attacking), zooming out by giving the client less information about the game state. I can't think of anything that helps with dodging and skillshots.

Re: Riot Games Approach to Anti-Cheat

#57

Post by orliesaurus » Tue, Jul 17, 2018, 7:38 PM UTC

aclelland wrote: post #39

Great write-up. I'm my job we spend a lot of time dealing with hackers and cheats for our mobile and PC games. We tend to see similar exploits across all our games (memory hacking, fake IAPs, etc) which lets us build an armoury of anti-cheat tools. What I find most interesting is where hackers don't focus their attention. It took almost 4 years for them realise the encryption key for our assets was easily accessible…

You're probably dealing with newbie reverse engineers, do you work for a triple A game publishing studio or an indie game shop? People who want to "mess" with games are usually doing it so that they can make a lot of money from it and therefore hunt big triple A games...the people I've seen do proper reverse engineer on triple A game to bypass ie. Blizzard's anticheat in World of Warcraft now all work for big "anti-virus" companies

Re: Riot Games Approach to Anti-Cheat

#58

Post by BanazirGalbasi » Tue, Jul 17, 2018, 7:38 PM UTC

rjvbk wrote: post #35

>We don’t share the state of other players if it doesn’t need to be shared, so we can avoid common cheats like “map hacks” (revealing all players on the map). >We let the server’s game simulation make the authoritative game decisions and generally don’t trust the information received from the client, which helps prevent common cheats like “god mode” and “disconnect hacks,” barring any overlooked exploits. >Our networ…

A lot of this information is written so that it's easier for laypeople to read and understand. Stuff like that may be obvious to developers and sysadmins like many of us, but to the common League player it might not be. Also, I doubt that they want to give away something more specific that would give a clue on how to beat their systems.

Re: Riot Games Approach to Anti-Cheat

#59

Post by keerthiko » Tue, Jul 17, 2018, 7:39 PM UTC

rjvbk wrote: post #35

>We don’t share the state of other players if it doesn’t need to be shared, so we can avoid common cheats like “map hacks” (revealing all players on the map). >We let the server’s game simulation make the authoritative game decisions and generally don’t trust the information received from the client, which helps prevent common cheats like “god mode” and “disconnect hacks,” barring any overlooked exploits. >Our networ…

The first is not all obvious. Oftentimes, it's simpler to share entire game state to all clients, and let the client obfuscate information based on the player's context. Especially for building a better player experience for interpolation/network lag correction when the server connection may fail to keep up.

Additionally, it's non-trivial logic to determine what "needs" to be shared: eg, what do you do with a champ that's outside vision but using an ability that enters your vision? There are important and difficult design, architectural and logic decisions to be made at every level from the game data models to the server-side simulations to the clients handling of it.

Re: Riot Games Approach to Anti-Cheat

#60

Post by gnarcoregrizz » Tue, Jul 17, 2018, 7:39 PM UTC

pythonaut_16 wrote: post #17

I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality. As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where d…

Not quite the same thing, but there were a lot of cheat-only servers in counter-strike in the 2000s with anti-cheat turned off (it's optional if you run your own server). Since it was all cheats vs cheats, whoever had the best ones won. The game servers were often very scriptable and modded as well.