This is a x-post from a couple months back. Enjoy the read.
------------------------------------------------------------------
The title says rant. Yes it's a lot of words. If you're interested in the state and/or history of anti-cheat, you may find some of this interesting.
Let's get the intro out of the way. I am a former cheat dev, specifically for games under BE and EAC. I haven't touched CSGO in years, though I would like to list some security implementations that other games have used, and how Valve could utilize them if they wanted.
To preface, there will never be a catch-all solution to cheating. You can add all of these and you will still have cheaters. The goal should never be cheater free, that is not an obtainable goal. The goal should be to heavily increase the barrier of entry in creating a cheat for your game, while also applying great pressure to those maintaining such a cheat.
Additionally, below I will not recommend a kernel anti-cheat, as I myself worked against those anti-cheats for many years and have met many who don't know what they're doing yet manage to make their cheats just fine. So to clarify, there are pasters in every game and people cheating on every anti-cheat at ever level.
I would also like to state that I've seen many games purchase a third-party kernel anti-cheat like EAC/BE, and rely on it entirely as a crutch with little-to-no internal or serverside checks. All of this to say, you can't just implement one component and expect to be cheater free.
With that being said, let's get into it.
Firstly, let's go over what Valve has done and has not done so far:
-Battleye, Faceit, and ESEA have all offered at one point to improve VAC without an intrusive kernel module. These offers were refused.
-Faceit serverside successfully detected what I will vaguely word as the most-common* aimbot implementation at the time. They also detected a few other features. They had these features for years before Valve ever implemented them into VACNet (their serverside anti-cheat). To clarify, Faceit used modified SMAC for these features and the code was common knowledge. Valve could have implemented them at any point.
-VACNet at one time at least, had flagged most* cheats on the market. I can explain these further if somebody asks, but the details are boring. Just know that VACNet did not ban most* of these users, and instead lowered their trust factor. These accounts are all still flagged today, even if their trust factors have increased. If you hear about the beta being a honeypot with limited clientside checks, it wouldn't matter if it was. Vacnet has been running for years and is able to ban tens of thousands of players right this second, but apparently that's not what VACNet is for.
-Fake angle controversy. To summarize, most implementations of packet-loss or "tickbased manipulation" features (think rage/spinning features) had to be patched by a current (at the time) cheat developer. Long story short, this was a patch that was thought to be able to end rage-hacking for good, yet this exploit was in almost every cheat source out there and the patch wasn't exactly rocket science. But Valve couldn't/wouldn't do it, until a cheat developer quite-literally spoonfed him the code.
There is a very funny story behind this, being that the dev thought if the other cheats didn't have fake angles his cheat would be the best, and it's even funnier when you realize this same guy is paid by four P2C sites to make them all perform the same, but that's stupid 'cheat drama' and a long story for another time. In summary, Shark's brain has an off switch.
Lastly, I want to give a glimmer of hope and show what CSGO or {insert game here} CAN do:
-Encryption: Destiny 2, Rainbow 6 Siege, and even GTA6 (whoops) have what I will simply call memory encryption. These games all implement encryption in different ways, I have placed them in order of strength in my opinion. With Destiny 2 having the weakest encryption, and GTA6 having the strongest (theoretically). There are resources to learn about this encryption, but I will only vaguely explain it. To modify memory, you need to find the location of the memory. Memory encryption shifts these locations around. I believe r6 shifts memory each minor update, GTA6 plans* either during each launch or even during runtime if practical.
What does this mean? Well in technical terms, it means you'll have to have some serious experience in pattern scanning. In layman's terms, it means you're fucked. The average paster will have no clue where to start, so basically the average developer / p2c site. There are rainbow 6 siege cheats and destiny 2 cheats don't get me wrong, but this makes it MUCH harder to make a cheat for the game, and will reduce the amount of cheaters in a game like CSGO by 95%.
-Lawsuits: This is exactly what it sounds like. I personally used to think that legal teams were the future of anti-cheat. A big example is Valorant. Vanguard isn't the strongest anti-cheat in the world, and it heavily relies on it's boot-level access as a crutch. When the game came out, it actually had very little internal checks, with the first cheat feature being to manually write your team number to the opposing team number, giving you the highlight effect and seeing them on the radar. This is funny because it's a very simple internal check to add. Anyways, if you managed to piss them off by bypassing their anti-cheat, and they find you have a public site, you will be receiving a cease and desist. If you do not desist, you are fucked.
I would say that most cheaters are using one of the larger well-known sites. Easy to identify and sue if valve wanted, though would be expensive. Quick note, most small cheat sites are not registered companies. So if their identity gets leaked, report them to the IRS. And no cheat developers, paying in bitcoin isn't a magical tax loophole.
-Hardware bans: We should all know what this is. A cheater gets banned on an account, the anti-cheat also bans select hardware so they can't buy a new account. This is standard across the industry. While yes it's very easy to spoof certain hardware serials, especially against a usermode anti-cheat, but that's not the point. This would greatly slow down the re-entry in the rare event a cheater actually gets banned.
However, this will NEVER happen. The steam client and account help page quite literally tell you to create a new account and buy the game again. This all goes towards my overall point being that it's not about the method of implementation, it's about the mentality of Valve. They ruin your experience to INFLATE NUMBERS and INCREASE REVENUE.
Conclusion:
At the end of the day, whether they add encryption or not, add a kernel component or not (which I don't recommend by the way), or implement anything I've suggested, their current core components are lacking. You can look at the VAC source code today and see plenty of holes and features they could add or update. It's not about adding one of these solutions and expecting a drop in cheater numbers, it's about the mentality.
And as far as this subreddit goes, you guys don't have the wrong idea, there is a rampant cheating problem. However, posting a fishy clip of your favorite streamer isn't going to fix anything. You know that a cheater buying the game 10 times is going to net them more profit than you just trying to play the game legit, and they know that too. At the end of the day, you the player are being screwed and you need to target the company and let them know how you feel.
All of your efforts should be towards targeting Valve and getting the changes that YOU want made. To clarify, by "targeting Valve" I don't mean maliciously. I merely meant that Valve is the developer, so you should target your attention to Valve if you want something changed.
TLDR / "I ain readin allat" : Pressure your game companies into trying harder. There is evidence of neglect in an abused system that rewards a negative gameplay loop, and proof that valve as a company holds inflating numbers and increasing revenue over providing an enjoyable experience.
I'll answer any question on technical specifics or previous events.
No comments:
Post a Comment