As someone who has been in the graphics card driver side of things for almost 3 years now, anti-cheat has been the bane of my existence. Some anti-cheat has been strong enough that is has actively stopped me from fixing games, doubly so when we can't get into contact with the game developers. I would not be surprised if in the future some games might just never run on one gpu due to a mix of anti-cheat, legal, and driver signing troubles.
While I have a massive disdain for anti-cheat enough that I've built hacks just so I can fix the games my employer pays me to fix, I'm not going to encourage developers to drop them if they truly think it's needed. But please, contact gpu manufactures and provide them the tools or builds needed to fix and debug your game.
Cheating in online gaming is such a blight on the industry. Such a waste of time & money for every legitimate participant in the market, except for the groups making and profiting of the cheats of course.
I still like my idea for a third-party reputation service that has consequences for not just one game but every multiplayer game participating in the program: https://news.ycombinator.com/item?id=28634784
I really do think it would make cheating non-existent, and allow developers to focus on building cool games instead of building invasive & ineffective rootkits we have to install just to play games online fairly.
At first I was optimistic that AI would greatly alleviate the issue here, but no dice.
As someone who was super competitive about the games they played (reformed, no longer play), I can tell you online cheating is completely out of hand.
There are cheats nowadays that don't even require software to be on your computer. You just put up a camera on your screen and an AI bot helps you by manipulating your controller (e.g., aim) - it really is a cat and mouse game and I don't think the issue in general will be resolved anytime soon.
I know there is an entire industry built around gaming and custom PCs so this is a pipe dream, but I'd love it if instead of all the time and effort that goes into supporting these rigs, the business models for consoles were optimized such that consoles could be top of the line rigs with very strict upgrade paths. This is really the only way I can see us actually putting a dent into this problem
> I still like my idea for a third-party reputation service that has consequences for not just one game but every multiplayer game participating in the program: https://news.ycombinator.com/item?id=28634784
So, essentially China's Social Credit Score, just for gaming... a bad idea IMHO, a really bad one.
For one, that centralized reputation service that actually has data linked back to government-issued credentials (ID cards, passports, ...) must be ridiculously secured, because it will be among the juiciest targets on the planet - be it trolls or deranged stalkers of either gender (although most tend to be male [3]), people are willing to go to ridiculous lengths to abuse fellow gamers, especially (large) streamers. Ordering pizza, SWATting, or even cases of rape and murder [1][2], all of that has happened. Give 4chan enough incentive and they will crack open anything. Or they'll just outright infiltrate the company, someone has to run it after all, and whoever has admin access, no matter the audits and internal controls, will find a way to exfiltrate stuff.
And even assuming the reputation service doesn't get hacked, the participant games are another target - this time, not for the data that's held by the reputation service, but for reporting "cheating" by the target person. Either technical bugs or infiltrating the customer service, both can yield results - game companies largely crap on code quality, even the biggest ones (remember Rockstar's GTA JSON bug lol), and customer service jobs are low paid and have high attrition, easy targets for infiltrators.
And then gamers themselves are also valid targets. Manage to get a piece of malware onto a streamer's computer that gets detected as a cheat, boom. And that's easy to do, RCE vulnerabilities crop up every now and then for major games (Minecraft for example had BleedingPipe and log4j, GTA had one in 2024 and in 2023).
Making some assumptions here but I suspect most game developers outsource their anti cheat to a 3rd party and that is what you are running into. Some of the 3rd party anti cheat rootkit computers. Some are okay and some are just terrible.
You're correct, most companies don't make their own anti-cheat. We have categorized the different anti-cheats and have ways around them where needed. But whether or not the game devs or some 3rd party makes the anti-cheats it still leads to the same problems, I'm blocked from fixing their games on our hardware. I can't/won't share to many details about or internal process.
> I'm not going to encourage developers to drop them if they truly think it's needed.
When I've only got an hour or two to game and my gaming friends can only get everyone together once a week, it's crushing to have a good game ruined by cheaters.
Hopefully gamedevs can work with people like you to fix bugs. However, leaving anti-cheat out of multiplayer games is a complete non-starter in today's environment. Even if anti-cheat only slows the cheat devs down and turns into a game of whack-a-mole with cheats, it's still preferable to having every game get crushed by cheaters every time you play.
Don't get me wrong I understand the sentiment there. I'm sadly locked out of most of those games from the get go being on linux though. Most of the games that give me trouble aren't online games to begin with. Most online games we do have good contact with the developers since they're typically actively working on the game.
Don’t really play multiplayer games anymore, but back when I did a lot there was a “vote kick”/“vote ban” feature that people used to get rid of the cheaters instantly sniping everyone from across the map, it wasn’t like they were very subtle.
Does that simpler social approach not work anymore?
As of about a year ago, Team Fortress 2 bots were so pervasive that they would often teamu p to use the "vote kick" functionality to kick non-bot players from public games.
This started about 5 years ago and continues today. They aimbot, spam both voice and textchat, dodge bullets, can fly, and hijack any vote to ensure their continued survival. If you can't get an invite to a private lobby you may as well play a different game. Either one that has anticheat or something singleplayer. If there was a silver bullet that made online play nice and respected your computer, someone would have shot it by now.
Ok that’s pretty hilarious, but what’s the point, is this just like playing battlebots for TF2 bot authors? (But if it was couldn’t they set up a purpose-built server for that?)
It hasn't worked for a looooooong time, you'd have 4chan and its offshoots running around coordinating offsite to yeet random players. And that was in an era where people had to pay for games and risked global bans (UT2k4 had that) on their license #, nowadays in the f2p game scene that has zero cost attached it's become all but pointless.
Some games this is still applicable. But as of a few years ago, there's been a LOT of multiplayer shooters coming out with a battle royale style of genre, where you load into a 30-40 minute match with a single life and are booted when you die. You don't have access to a list of players at any point or votekick/voteban mechanics, at best there'll be a report button on the death screen if you thought something was fishy. So you really have no way of knowing in these games at what point the match will be ruined, someone can toggle cheats on 20-30 minutes in and you won't know until you die to them nor have any way to communicate that to the other players still ingame.
When they first added this feature to Overwatch, one of the best sniper players in the world got banned because people thought he had an auto-aim cheat. Turns out he was just really really good.
Question for people that build hacks: given how robust this open-source anti-cheat is, does building the cheat give more reward than playing the game? It seems like it would take a ton of hours to be effective..
I've built hacks to undermine recurring payment structures in games. It has very little to do with cheating, and everything to do with fighting a corporate trend that I would like to see abolished in games.
Gaming companies care far more about these kind of hacks, but frequently lump them into the "cheating" category for better optics.
There is huge money in making cheats and this one seems to operate in userspace only. Most cheats and anti-cheats these days are running in lower rings (kernel or device driver)
I believe there is also hardware cheats but I'm not sure how common those are. EDIT: See "DMA cheats" or "DMA cards"
Go to aliexpress. Google cheat cards. They've proliferated pretty heavily in the last couple years.
My buddy and I were actually just discussing ring 0 anti cheat circumvention and we started researching these units. Our guess is that the hardware slightly changes every iteration with updated firmware to circumvent general heuristics like HWID.
> does building the cheat give more reward than playing the game?
Absolutely! At least for the kind of people who like cracking games. Think of it as a puzzle game.
Being able to play the game as a cheater is like getting the final weapon in a game where it requires completing the most challenging part. You have fun for a bit, destroying everything in your path, that's your reward, but you quickly lose interest as you have nothing interesting left to do.
Just like any software, game cheats are build once, sell as many times as you can. If a game is popular, this can be a very lucrative business. The fact that game developers will play the cat and mouse game with you to block you out only adds to this fact, as so long as you can keep up, you can get repeat customers.
Now I want to read an article about the economics of selling game hacks. I just assumed they weren't really worth the investment to build since the number of people that want to cheat seems low.
After typing that I realize this is like coming to understand just how many people are on steroids to get a physique they want. It's like nah no one takes steroids except EVERY HUGE PERSON you've ever seen, barring the extremely rare genetic outliers.
yes- I have been out of the "game" for a while, but, the economics are strong. Used to sell bots that could automate tasks to get gold in various games (WoW and Runescape as examples) and we had customers that would buy 100s of licenses monthly and had factories that they'd use to farm and then sell the gold on eBay, etc.
I wonder if a statistics-based cheating detection system could work in more of the esports style games? Chess.com seems to have a pretty good method to detect cheaters based on analysis of post-game data: https://www.chess.com/article/view/chess-com-fair-play-and-c...
Even in something like an FPS, if player movements or action patterns could be compared to normal patterns, it would be incredibly obvious who is cheating regardless of HOW the player managed to cheat.
Even something as elaborate as a full AI-powered robot that physically hit the keys could be detected when it made a move that was not within the patterns of human players.
Of course, the cat and mouse game then becomes more about the cheat algorithms learning to act more human to avoid detection, but they have a long way to go. Plus, each time they have to adjust and become more human, the less and less of an advantage the cheater has!
I'm not actually good enough at anything to be tempted to cheat, even if I were persuaded to become ethically OK with it. But if I were, I think that's where I'd start. Oh, some game is blocking a specific model? A recompile of the firmware says look at me, I'm a Microsoft Ergonomic Keyboard!
Nobody wants that running on their computer though.
Maybe it's time to just give up on PC gaming and use dedicated game consoles instead, which are locked down by design? The only real alternative seems to be running a cryptographically-verified known-good OS signed by one of the big three OS companies, which is also locked down enough such that cheating becomes impossible, or installing what is essentially kernel-level malware, just to play the latest games.
Games or esports? Riot’s Valorant used a kernel level anti-cheat that needs to be enabled at boot.
It’s super problematic from a security perspective.
That being said, I’ve played competitive FPS games my entire life, and valorant is the only game I’ve never ran into a cheater in. So it works, and I’ll say, it should be a hard requirement going forward for the anti-cheat to be a core part of the game architecture. A game getting popular enough to attract cheat developers to make an sdk for a game isn’t “suffering from success.” It’s a death sentence for the game. There are popular streamers and YouTube content creators out there that go through extreme lengths to avoid cheaters, but in the end they always just stop playing the games.
Pretty much all anticheat is kernel level because that's where hacks are now, it was not a new thing when vanguard came out either, it had been like this for years already.
Not that it matters that much for data privacy if you game on the same user anyway as userspace anticheat can access all your users data.
Readit News
While I have a massive disdain for anti-cheat enough that I've built hacks just so I can fix the games my employer pays me to fix, I'm not going to encourage developers to drop them if they truly think it's needed. But please, contact gpu manufactures and provide them the tools or builds needed to fix and debug your game.
I still like my idea for a third-party reputation service that has consequences for not just one game but every multiplayer game participating in the program: https://news.ycombinator.com/item?id=28634784
I really do think it would make cheating non-existent, and allow developers to focus on building cool games instead of building invasive & ineffective rootkits we have to install just to play games online fairly.
As someone who was super competitive about the games they played (reformed, no longer play), I can tell you online cheating is completely out of hand.
There are cheats nowadays that don't even require software to be on your computer. You just put up a camera on your screen and an AI bot helps you by manipulating your controller (e.g., aim) - it really is a cat and mouse game and I don't think the issue in general will be resolved anytime soon.
I know there is an entire industry built around gaming and custom PCs so this is a pipe dream, but I'd love it if instead of all the time and effort that goes into supporting these rigs, the business models for consoles were optimized such that consoles could be top of the line rigs with very strict upgrade paths. This is really the only way I can see us actually putting a dent into this problem
So, essentially China's Social Credit Score, just for gaming... a bad idea IMHO, a really bad one.
For one, that centralized reputation service that actually has data linked back to government-issued credentials (ID cards, passports, ...) must be ridiculously secured, because it will be among the juiciest targets on the planet - be it trolls or deranged stalkers of either gender (although most tend to be male [3]), people are willing to go to ridiculous lengths to abuse fellow gamers, especially (large) streamers. Ordering pizza, SWATting, or even cases of rape and murder [1][2], all of that has happened. Give 4chan enough incentive and they will crack open anything. Or they'll just outright infiltrate the company, someone has to run it after all, and whoever has admin access, no matter the audits and internal controls, will find a way to exfiltrate stuff.
And even assuming the reputation service doesn't get hacked, the participant games are another target - this time, not for the data that's held by the reputation service, but for reporting "cheating" by the target person. Either technical bugs or infiltrating the customer service, both can yield results - game companies largely crap on code quality, even the biggest ones (remember Rockstar's GTA JSON bug lol), and customer service jobs are low paid and have high attrition, easy targets for infiltrators.
And then gamers themselves are also valid targets. Manage to get a piece of malware onto a streamer's computer that gets detected as a cheat, boom. And that's easy to do, RCE vulnerabilities crop up every now and then for major games (Minecraft for example had BleedingPipe and log4j, GTA had one in 2024 and in 2023).
[1] https://www.nytimes.com/2023/03/11/us/podcast-husband-killed...
[2] https://thelmaarose.wixsite.com/whattaweek/post/a-female-gam...
[3] https://www.businessinsider.com/twitch-streamers-are-being-s...
When I've only got an hour or two to game and my gaming friends can only get everyone together once a week, it's crushing to have a good game ruined by cheaters.
Hopefully gamedevs can work with people like you to fix bugs. However, leaving anti-cheat out of multiplayer games is a complete non-starter in today's environment. Even if anti-cheat only slows the cheat devs down and turns into a game of whack-a-mole with cheats, it's still preferable to having every game get crushed by cheaters every time you play.
Does that simpler social approach not work anymore?
This started about 5 years ago and continues today. They aimbot, spam both voice and textchat, dodge bullets, can fly, and hijack any vote to ensure their continued survival. If you can't get an invite to a private lobby you may as well play a different game. Either one that has anticheat or something singleplayer. If there was a silver bullet that made online play nice and respected your computer, someone would have shot it by now.
Gaming companies care far more about these kind of hacks, but frequently lump them into the "cheating" category for better optics.
Bad games don't deserve your time any more than they deserve your money.
I believe there is also hardware cheats but I'm not sure how common those are. EDIT: See "DMA cheats" or "DMA cards"
My buddy and I were actually just discussing ring 0 anti cheat circumvention and we started researching these units. Our guess is that the hardware slightly changes every iteration with updated firmware to circumvent general heuristics like HWID.
Several hundred hours of my "the finals" experience have been helped by this :)
Absolutely! At least for the kind of people who like cracking games. Think of it as a puzzle game.
Being able to play the game as a cheater is like getting the final weapon in a game where it requires completing the most challenging part. You have fun for a bit, destroying everything in your path, that's your reward, but you quickly lose interest as you have nothing interesting left to do.
After typing that I realize this is like coming to understand just how many people are on steroids to get a physique they want. It's like nah no one takes steroids except EVERY HUGE PERSON you've ever seen, barring the extremely rare genetic outliers.
Fascinating.
Most of my users seem to agree that yes, it is more reward than just playing the game.
Its a constant arms race, at least until the AC devs bow out.
There is no 100% perfect solution. There are tons of ways to circumvent anti-cheats using a second computer as well.
Even in something like an FPS, if player movements or action patterns could be compared to normal patterns, it would be incredibly obvious who is cheating regardless of HOW the player managed to cheat.
Even something as elaborate as a full AI-powered robot that physically hit the keys could be detected when it made a move that was not within the patterns of human players.
Of course, the cat and mouse game then becomes more about the cheat algorithms learning to act more human to avoid detection, but they have a long way to go. Plus, each time they have to adjust and become more human, the less and less of an advantage the cheater has!
Deleted Comment
No, like, literally.
Anti-cheat needs to be more or less a kernel level remote code executor.
Maybe it's time to just give up on PC gaming and use dedicated game consoles instead, which are locked down by design? The only real alternative seems to be running a cryptographically-verified known-good OS signed by one of the big three OS companies, which is also locked down enough such that cheating becomes impossible, or installing what is essentially kernel-level malware, just to play the latest games.
Modern games all have 10GiB+ updated constantly that you're not disassembling.
What's the difference?
It’s super problematic from a security perspective.
That being said, I’ve played competitive FPS games my entire life, and valorant is the only game I’ve never ran into a cheater in. So it works, and I’ll say, it should be a hard requirement going forward for the anti-cheat to be a core part of the game architecture. A game getting popular enough to attract cheat developers to make an sdk for a game isn’t “suffering from success.” It’s a death sentence for the game. There are popular streamers and YouTube content creators out there that go through extreme lengths to avoid cheaters, but in the end they always just stop playing the games.
Not that it matters that much for data privacy if you game on the same user anyway as userspace anticheat can access all your users data.
Dead Comment