We outsmarted CSGO cheaters with IdentityLogger (opens in new tab)

> IP bans only go so far with VPNs

Even without this IP bans only go so far as they're both easily swapped (VPN offers, or rent a VPS to forward traffic, or even by design with an ISP handing out dynamic IPs on router reboot) AND overreaching:

- NAT: ban household / campus

- CGNAT: ban whole neighbourhood

- IPv6: ban whole /64 => whole household (because of SLAAC + random privacy addresses)

OK, https://redman.xyz/git/schachtmeister2 now works (cgit), and it can be cloned, too.

Is there still an active tremulous community? I have fond memories of that game.

Residential VPNs are more common now with cheaters to bypass VPN blocks.

> There's also "illegal" amx plugins and commands, which are generally frowned upon and extremely abusable, but quite useful in these situations. My favorite (which most of the "illegal plugins" are based around) is amx_exec which essentially gives admins direct access to any client's in-game console, to run any command or set any setting!

Yes, we have something similar for UT2004, but only a handful of people are even aware it exists. It's too powerful and too easily abused. I have yet to share it, even with other admins.

Changing steamid is easily doable on most nosteam cs 1.6 copies through a cfg file.

I used to administrate CS 1.6 until a few years ago. I got a question concerning amx_exec. I thought cl_filterstuffcmd basically killed any usage admin slowhacking?

or is it that most nosteam cs 1.6 client have it set to 0 ?

It seems to me that what is needed is a "provisional" server that grants you access to the "good" server.

So an GUID accumulates reputation after some amount of play in the provisional server. If you get enough reputation by not cheating, the GUID gets whitelisted for the "good" server. You can have multiple tiers, so the really good/fun people get to the third of fourth tier of demonstrated non-cheating.

If they cheat, get banned, they need to climb the tiers with GUIDs again. The cheaters will want to cheat, they won't want to pay the dues. The legit players will happily try to get to the second and third tiers, so you could probably just require 1 hour of not-cheating for the first tier of server, and then maybe 8 hours to get to the third tier.

You could shadowban/honeypot after the first tier, so you shut all cheaters that you detect to their own cheater server where the cheaters can all get shunted to.

The tactic 4chan uses:

Regular IPs can post freely

VPN or mobile IPs (blacklisted) must pay for a key ($20/year) that allows posting from blacklisted IPs. Key is good for posting from one blacklisted IP, locked for 30 minutes, so users cannot share keys. That way, you can ban the user by their key, if their IP is public.

It's not a perfect solution but it seems to be the best they've found for such a situation so far.

> This still leaves you wide open to cheaters using mobile data tethering and proxies

Is latency going to be good enough on mobile data (especially if they're also using proxies) for a FPS, though? Sure, they're using cheating software, but I wouldn't be surprised if the software gets the information it needs to cheat too late often enough for it to be useful.

Want does mobile data tethering make it harder to ban an IP address?

Using a VPN with WireGuard can actually reduce latency if your ISP has poor routing to the game server, as a VPN with better peering or routing paths can improve your connection. It’s not always the case, but with a decent provider, you might see lower ping in certain situations.

> Who is gaming in a competitive game behind a VPN..

Cheaters, which is why they’re getting banned in the first place

When I was in the dormitory (~6-8 years ago), I used VPN (OpenVPN on my private VPS) over UDP port 53 to omit the firewall which was configured to block big parts of ports.

Can help routing induced latency as the other comment says (or force a new route if having downstream issues with your ISP peering), and some games in the past could leak IPs especially if using a p2p model and a VPN can mitigate that (especially one that only routes traffic for the game).

IIRC you also need one when playing from some countries, whether due to legal reasons or server restrictions.

Lota of competetive players pay for a vpn to protect against DoS attacks.

There's a bunch of services that can moderately reduce latency by using better paths. Specially worth it if you want to play with friends in servers farther than 1000km away.

My VPN is always enabled, including when I game

It's more effort than it's worth. There are server aimbot scanners which do something like this. There are also aimbots written to thwart this type of detection, adding delays, random drift, etc. It's a cat and mouse game. We don't have a lot of players left so it's not that much of an issue.

Some “aimbots” don't actually assist with the aiming, they just fire the trigger any time the user gets on target.

This is part of what Valve does in CS. It works pretty well but it does have false positives so it requires user intervention for confirmation of bans.

In order to actually catch a cheater mid-match rather than long after the match is already over, you'd need the servers that players are interacting through to have enough CPU grunt-force to do that kind of analysis "faster than realtime" — i.e. for the server's CPU to be able to run the game's physics faster than any client can, so it can run the physics with extra math in the same time it takes the clients to just run the physics.

Which might be something you could guarantee, if the game were locked to wimpy console hardware; or if the game had minimal CPU physics such that it was effectively never running CPU-bottlenecked and there were massive gaps in frame-time where even the client CPUs are sitting idle, that a server running in lockstep could cram that kind of analysis into.

But gaming is a race-to-the-top, hardware-wise. The CPU in a gaming rig might not have as many cores as your average server CPU, but it's almost certainly going to have higher single-core perf.

And part of the reason for that, is that games really do try to use your whole CPU (and GPU), with AAA studios especially being factories for constant innovation in new ways to make even the minimum requirements just to run a game's physics, higher and higher every year.

And if the server can't do "faster than realtime" analysis of the streams of inputs of the players, then by queuing theory, it'll inevitably get infinitely backlogged — the server will keep receiving new analysis work to do every timestep, and will fall further and further behind, never catching up until new work stops being generated — i.e. until the match is over. And then it'll have to probably sit there for five more minutes thinking really hard before spitting out a "hey, wait just a minute..." about any given match.

Which is fine if there's a big central lobby server that the game is forced to connect to, and your goal is to ensure that some central statistic that that central server relies upon (e.g. match-rank ELO) gets calculated correctly, such that cheaters are prevented from climbing the leaderboards / winning their way into high-ranked play. (And that's exactly the situation the big eSports games companies are in.)

But in the context of older games that use arbitrary hosted servers and random-pairing (or manual lobby-based match selection) — or in modern, but "dead", games, that only persist due to being modded to accept private servers — this "after-the-fact" punishment is useless, as most servers have no incentive to do this analysis, especially when cheaters can just hop around between servers. So there's nothing preventing people from being matched with cheaters, sometimes over and over again, if the cheaters can just tell their clients to roll up with a new key+IP for every match.

...and that's assuming there even are servers. You can forget about any of this working in a p2p context. (Think about what a Sybil attack means in the context of a federated set of individual tiny disconnected p2p networks.)

Yes, we have a whitelist ability also, but it is definitely a last resort. The game is mostly dead and difficult to discover for new players. We don't want that roadblock if we can avoid it.

VPN blocking is a cheap mitigation that stops 95% of the problematic traffic without removing a meaningful number of legitimate users.

Yes it doesn't "solve" the problem, and yes it removes some legitimate users, but it's by no means useless. Given the tradeoffs involved I'm not at all surprised it's so common.

If you have a solution that's less invasive (e.g., some businesses can get away with not providing anything expensive till after a payment has cleared the normal fraud window, and many businesses don't have obscene levels of malicious traffic; in those cases you can just let bad traffic run rampant and ignore it till it's a problem) then that's probably better, but blocking VPNs or whole countries or whatever can be the difference between a successful business and bankruptcy.

Excluding someone on VPN from playing UT2004 on a specific server is not an abuse of their human rights

IP bans are fundementally flawed since you can't assume a static IP in the vast majority of cases anymore, if you rely on an IP blocklist then it's inevitable that you will end up hurting the experience of small amount of unlucky but innocent players. I suppose this might be more of an issue on ipv4 than it could be on ipv6, but really you should always expire IP bans to avoid issues like these, or you want to combine another data point with the IP such as a hardware ID (or a hash of a combination of hardware IDs). Cheaters do know this so even if we could assign everyone a static ipv6 they would likely just disable ipv6 support on their NIC and rely on their ipv4 exit ip.

Edit: If you don't think this is an issue I urge you to Google "pokemon go belgium ip ban" for a fun rabbit hole.

Sort of. Doesn't make sense to ban a single v6, you'd start by banning at the /64 level and move on to banning shorter prefixes from there.

You quickly run into the same kinds of problems you do in v4 though; most users have access to a shared pool of addresses, and you may need to ban the whole pool to ban an abuser, but then you also ban everyone else in that pool, and the abuser is more likely to have ability and motivation to use other pools.

It's better if you have multiple factors... if you don't like the IP, don't ban it, but be stricter on other measures, etc. So a well behaved client from a 'bad ip' can still play, but enough suspicious things and you can't play anymore.

No, that figure is way off. Check out a website that sells digital goods or cheats and you will see that even far smaller games have cheats available.

Escape from Tarkov comes to mind. An extremely hard and niche first person shooter with RPG elements. It is a private Russian company so we don't know exact player numbers, but it is estimated to be ~200k by some hits in a google search.

There are people who will provide carry services and guns and gear for plenty of people who will pay for it, as well as other providers selling the cheats that the carriers use for a weekly fee. The people who are providing these services are getting paid in USD when their local currency has a far lower value. It isn't a moral thing, it is a money thing.

You know that you sometimes don't know a bug exists before someone exploits it or uses your software in a way that you did not think of. There are experts who stand to make tons of cash if they can create or use an exploit that people will pay money to advance with.

The only way to prevent this is something that no one wants to hear, but it needs to be a unique citizenship identifier of some sort, since HWIDs and other means of tracking are mostly useless.

Any decently competitive scene is going to develop cheaters in some form or another. MOBAs, Minecraft, Fortnite, at minimum I've heard about cheating some form or another. Any speedrunning community is going to face cheaters in some form or another doesn't matter what community you are talking about.

FPS games are kind of the gold standard when it comes to competitive environments, and thus gather cheaters or people complaining about cheaters substantially more than most other game genres.

One thing to note is that CSGO can be considered a play-to-earn type game; you play the game, get lootboxes, get lucky, sell the item for... idk, hundreds? thousands? So it's an incentive to cheat and buy new copies of the game if found out. A single item can be a month's income easily.

Mind you I don't know if that's the case on privately hosted servers as well, since those could be manipulated to give players the points needed to get the lootboxes.

Cheating is commonplace in lots of games much smaller than that. Company of Heroes 2 (an RTS released in 2013) for example is pretty much ruined by map hackers.

Well, it's just a genre that's immensely popular and easy to cheat in.

If you have access to the game's memory etc, it's pretty easy to create an aimbot or thing that lets you see thru walls et cetera.

How you gonna cheat in a moba? It's a strategy game, you need, like, cutting edge AI to beat the best humans at it. In fact OpenAI specifically worked on an AI to play Dota 2, it was that hard.

Maphack that gives vision of other players and resources is a common cheat in many games, including very popular moba games.

I think that's a very naïve way of looking at game development. There are many reasons why games are exploitable besides lack of reasonable dev effort.

- Almost all games are going to use a licensed or shared game engine. That means the softwsre architecture is already known to skilled cheat developers with reverse engineering skills.

- Obfuscating the game will only go so far, as demonstrated by the mixed success of Denuvo DRM.

- The game will not be the most privileged process on the machine, while cheaters are glad to allow root/kernel access to cheats. More advanced cheaters can use PCIe devices to read game memory, defeating that mitigation.

- TPMs cannot be trusted to secure games, as they are exploitable.

- Implementing any of these mitigations will break the game on certain devices, leading to user frustration, reputation damage, and lost revenue base.

- And most damning, AI enabled cheats no longer need any internal access at all. They can simply monitor display output and automate user input to automate certain actions like perfect aim and perfect movement.

Because at the end of the day the game is running on the user's machine, a machine in which the user has full access to every part of the execution and the software developer does not. You can only get around that by streaming the game instead of running it on the client side and even then an aimbot or some type of automation would be possible nowadays.

> I think a better question here is: why is game code so exploitable?

The nature of FPS games means only environment integrity can stop cheating. It's not exploitable per se. Just the game skill can be done by a computer perfectly.

Conversely who knows how long it will take for AIs to play Hearthstone with never-before-seen-cards well.

This isn't the better question.

When you have software running locally, you can arbitrarily modify how it runs.

Like an aimbot is a powerful cheat, and there's no amount of security that can prevent one from being used outside of an anticheat being able to look deep into what your system is doing, what it contains. The only way to prevent that kind of thing is to remove your control of your own computer.

Oh, that's an easy one.

- GOOD software are simple and easy to understand, which makes it EASY to cheat.

- BAD software are needlessly complex and finicky, so it's HARD to rig it for a cheat.

- Anti-cheats intentionally make software BAD and over-complicated, so cheaters would have hard time modifying it. But computers are brittle and also aren't smarter than humans so cheaters will eventually find a way.

- Security is completely irrelevant topic since game clients are "bought" and run on your hardware; Digital Restrictions Management built to work against you as user is anti-consumer, anti-right-to-repair, anti-human, super bad thing, and lots of efforts are made to keep PC away from it as much as practical.

It has nothing to do with laziness or cost. If anything it'll be the best programmed game that gets hacked fastest. And PS2 that gets emulated last.

Architecture can help up to a point but it can't stop everything - the usefulness of ESP can be reduced by not sending the client information it doesn't need to know, but that gets computationally expensive on the server, and culling information too aggressively can interfere with lag compensation. Perfect recoil compensation can be prevented by not replicating the servers RNG state on the client so it can't predict where the next bullet will go, which CS:GO started doing at some point. Aimbots though? Those are just automating an input the user could theoretically make legitimately, so you're pretty much stuck with statistical heuristics or client-side detection.

No kidding, implementing multiplayer as a VNC session on a controlled server is very expensive.

Priorities. Games need content and performance. Give game developers more budget, and they will work on making the game faster, fix game breaking bugs, and add content rather than make the game less exploitable.

And cheats do not always rely on exploitable bugs. A bot using screen capture and input device emulation works at the OS level and in other contexts (ex: accessibility), it would be a legitimate thing to do.

It’s not that simple.

Some games aren’t able to prevent cheating. The client has the data on where the enemies on their screen are. The cheat only needs to move the mouse and click on the enemies heads. Other games like MMORPGs involve the cheat just playing the game and farming on behalf of the player.

It just becomes a cat and mouse game where the anti cheat is trying to detect something hooking into the game process while the cheat tries to hide itself.

A very large amount of games that are released nowadays all use well known and well documented engines, that's what makes it a lot easier, there's an interview on YouTube with a company that develops cheats for multiple games that mention this here: https://youtu.be/zwruk-tLIOU?si=3O2jBKQneur-n3iS

I think GP's last line covers it. It's the same reason why DRM is ultimately ineffective, and why even companies that work hard and spend time and money to secure their infra still sometimes get popped: the game devs have to be perfect 100% of the time, but the cheaters only have to get lucky and find a flaw once.

Yeah, my immediate thought was this would be bad for screen readers, plus OCR could easily defeat this

That likely wouldn't work, doesn't mean the letters were simply rotated. Would probably be just random.

Could be an arbitrary permutation or worse have multiple equivalent characters. Fonts can do a lot.

I know right? I just scraped another website instead.

I am actually surprised no one went: "actually that technique is called 'chicken ostrich sandwich' and was first employed in babylon in 2000BC"

I dunno, I never measured it. If you are scraping billions of small social media posts I would expect it to add up and make it unviable.

It pre processes your photo library while charging

You need OCR unless you're going to personally sit there and break it by hand so you can feed the tr/// translation yourself every time you need to scrape. And it's a bit more tedious than the puzzles we did as kids, likely the punctuation and lowercase/uppercase were mixed into the slop.

> Only problem is, a lot of companies do NOT want to pay for it.

Because they're 10 years behind the curve and don't understand that a game's lifespan is contingent on anti-cheat. Once it becomes clear to the casual player that a hacker is going to effect every gaming session, the game dies quickly. Many games have gone so far as to obfuscate the presence of hackers so that players are less likely to notice them (CoD)! Other games build from the ground up with anti-cheat in mind (Valorant). Other games have an ID verified 3rd party system for competitive play (CSGO).

Personally, I think there is a middle ground between root level hardware access, and treating cheating as an afterthought. I'd lean more heavily on humans in the process... Use ML models to detect potential cheaters, and build a team of former play testers to investigate these accounts. There is zero reason a cheater should be in the top 100 accounts; An intern could investigate them in a single day! More low hanging fruit would be investigating new accounts that are over-performing. I'd also change the ToS so legal action could be persued for repeat offenders. Cheaters do real economic damage to a company, and forcing them to show up in small claims court would heavily de-incentivize ban evaders. This probably sounds expensive and overkill, but in the grand scheme of things it's cheap; it could be done on the headcount budget of 2-3 engineers. It'd also be a huge PR win for the game.

My idea:

1. Determine minimum human reaction times and limit movement to within those parameters on the client side. (For example a human can't swing their view around [in a fps] in a microsecond so make that impossible on the client) this will require a lot of user testing to get right, get pro players and push their limits.

2. Build a 'unified field theory' for your game world that is aware of the client side constraints as well as limits on character movement, reload times, bullet velocities, etc. Run this [much smaller than the real game] simulation on server.

3. Ban any user who sends input that violates physics.

Now cheating has to at look like high level play instead of someone flying around spinbotting everyone from across the map. Players hopefully don't get as frustrated when playing against cheaters as they assume they are just great players. Great players should be competitive against cheaters as well.

Are there more sophisticated cheat developers though?

> now that YOLO-based aimbots exist

the what ?!?

Why pay for the game when you can go to an onion site that will sell you hundreds of compromised accounts that own the game for a fraction of the price?

Charging money and banning at the payment provider level can be quite effective. It isn't a perfect answer but it cuts out gigantic chunks of the problem space.

I'll take a ~99% cheat-free experience over not having any improvement at all.

That's fair. There will always be cheaters like this. However, anecdotally, after CS or any other game I've played that went free-to-play, cheaters became a much much larger problem: from seeing one every now and again, to at least one in nearly every match.

I could be wrong but couldn't you just get a pcie card that is effective a tpm card?

Knowing how well Valve handles stuff like this you re-roll the keys in Proxmox and play again

I would wager most people just move onto a different server - leaving you with useless/suppressed data on how many people this may have impacted.

You would need to ban random people and see how many of them report it to estimate the real amount of such errors.

No, not specifically. That section is still written under the misconception that IPs are bound to households, or static networks like university networks. Instead they can swap at the very least country wide (or rather, however the provider manages the IP addresses it controls). Their mental model is just not how the internet works.

By using IP as the ban id they created a system that constantly and regularly banned completely innocent steam IDs, thinking they are somehow linked when a new steam id uses a banned IP, which is nonsense. They just did not notice because the banned gamers did not complain.

I always found it funny how ip bans seemed to be so popular despite being apparently completely ineffective until I realized this was mostly a US thing. In my country (2 of them that I've lived in, in fact) ISPs always assign the client a dynamic address from their very large pools every time I reconnect. This was as true back in the 28.8kb dial up days as it is in the 10gbit FTTH days we live in. Having a static IP address here has always been a service you have to pay for.

I remember this being hilarious when idiots would ip ban me back on the IRC days: "oh no, I have to press the reconnect button!"

They added the third identifier to detect ban evasion by changing the Steam ID and the IP address.

They implemented some specific exceptions but generally recommended to not play on untrusted networks to avoid getting banned along cheaters in the same network.

That's my take from the article.

I'd agree if it was being used to ban players across many servers, but a single community server is not that big a deal to be banned from. And they seem to have had an appeals process.

Do they need to cheat to get drops though? It's been a good while since I've played CSGO but I thought the drops there were similar to TF2 where you just get them on match end and it's not tied to player performance at all?

What a bunch of absolute losers. If it's taught me anything though, it's that you can't underestimate the pathologies of people you encounter 'in the real world'.

Yeah I get that, I understand why cheat developers do what they do. It seems like there's a huge market and I find it hard to blame them trying to make a living- morality wise they're probably more worried about rent, bills, family than whether or not someone's game time is ruined. But it's only this way because so many people are willing enough to cheat that dropping money on it is fine for them. It's their psychology I don't really get. Even if they're doing it because they want the satisfaction of a "win", doesn't that victory feel hollow because it's something they paid money for? It's like the difference between a community valuing you enough to give you an award vs going down to the trophy shop and paying someone a make you your own trophy that doesn't really mean anything.

But in that case I suppose you could pass around a disk, at least for physical. For digital-only I imagine it would be more expensive.

Well that's annoying. Perhaps they just aren't being detected?

They're perhaps not required to gather explicit opt-in consent, but my understanding is that they'd be required to disclose what information they collect/store.

GDPR is toothless eurotrash.

I saw a consent form that had 72 optional, 21 “legitimate interest” cookies.

GFB

I didn't use Gamespy but did use "The All Seeing Eye"

https://en.m.wikipedia.org/wiki/The_All-Seeing_Eye which was sold to yahoo.

Yahoo was a powerhouse back in the day and one that google offered to sell to. The world would be so different if it had.

Sure but that can be completely randomized, no? like keep changing folder where cookie gets hidden, or the ID generated.

Even the Webgl signature check is resilient, and is the new tracking cookie on many sites like YT etc. It is a robust unique property of a specific system, and GPU. Not just the serial number...

Indeed, duplicate salted-hash signatures on multiple active users mean shills, and immediate bans issued for both accounts tainted by the black list.

The trick is to randomize a mix of easy and difficult signature checks daily.

i.e. the exploit writers will have to spend time cleaning up bugs, redistributing the patches, and dealing with angry people that have a GPU that is on the blacklist for a game. The more hardware details collected, the more difficult it is to prevent tripping the admin alert.

This is already done by some studios... "Play Stupid Games, Win Stupid Prizes" as they say... =3

You’d compare all the telemetry you can from a sample of non cheater users and compare that to the cheater. Chances are the cheat is better than a non cheat user because thats the entire point of cheating. It will probably manifest in stuff like accuracy for aimbots, how fast they train onto a target they see, if they put their reticle on another user through a wall and how often that happens, how they move or jump, etc. theres bound to be some significant difference in some of these or other metric compared to non cheaters. And if there is no significant difference, maybe the cheaters don’t have the edge they thought they did after all and you don’t need to worry about it.

> but you're ruining the experience of others when hacking in multiplayer games

What I meant was, cheating can be a good learning experience to programming for a lot of kids, because they get immediate feedback and rewards. At least that's what I see it as.

They said if a user changes their IP and SteamID then it would be considered a new user and they wouldn't know.

What did I miss?