Game Developers Cracking Down on Cheating 510
Hector73 writes "ZDNet has an article discussing a growing concern for the makers of on-line video games. Cheaters and trolls are making it harder for casual users and newbies to get hooked on the on-line versions of games. Considering that on-line gaming may become the major revenue source for game makers over the few years, maybe they will actually do something about it."
One method (Score:2, Insightful)
PKI? (Score:5, Interesting)
I agree. Playing with people you know is probably much more fun too.
The only other solution I see is a -- and you've heard me say this before -- a web of trust. Integrate game-matching / chat and a PKI. Players will sign the keys (this can be abstracted in the GUI of course to make it simple) of players they trust and enjoy playing with.
Then it is up to the players, some may risk it and play with anyone, others might only play with close friends, and the majority might opt for the middle ground and play with any player within some distance of the web of trust.
You could do a lot of things with this. A client could chose to play any other client based on the number of signatures and their age (trusting it even if there is no path to it), etc.
Re:PKI? (Score:3, Insightful)
Re:One method (Score:2)
Shoddy code? (Score:3, Insightful)
That, or me standing behind you with a baseball bat at the ready while you play.
Valve left the Half-Life code more "open" for a reason. Counter-Strike is the biggest. Mods don't show up often if you try to lock down your client code too much.
Counterstrike (Score:2, Interesting)
I don't mind products to even the playing field (a 12 year old with OGC can ruin a whole game you've been in for hours), but when they interfere with game play, what's the point?
Re:Counterstrike (Score:2)
I dont know what servers you are playing on but I run my own CS server and admin/manage 3 others and I havent had csguard or HLGuard crash my server even once. Agreed There were issues the day 1.4 was released but that was due to needing a metamod update for Adminmod to work.
Also you have to realise that many server admins dont know or dont follow the hlds server mailing lists so they may be unaware of necessary updates for the different mods they run on the server.
As for cheating, any form of cheating takes away all the fun in the game. 90% of the people who cheat, dont cheat to get a good score, they cheat to piss off the players who are on the server. HLG and CSG arent *that* accurate , the best anti cheat for CS was Cheating Death and even if the person had cheats it didnt really matter since C-D would disable most of them. But no anti-cheat is as good as an experienced Admin who is playing and who can tell the difference from a cheater and a good player.
dvNuLL
Re:Counterstrike (Score:3, Interesting)
With regard to HLGuard and CSGuard, I have found that they are buggy. For example, when attempting to change your name on a server and using a % in order to have spaces (e.g. Counter%Strike%Player), CSGuard will automatically cause your Half Life to quit. And one of the latest revisions of VAC kicks people off with no cheats installed -- this has happened to me. But eventually these bugs will be fixed, and pretty soon admins will find that they no longer need to run HL/CSGuard to reliably catch cheaters.
Re:Counterstrike (Score:2, Interesting)
Xbox live to combat cheating (Score:4, Informative)
Re:Xbox live to combat cheating (Score:2)
And in MS's case, I thought they already had something like 500,000 game servers setup. Aren't they running a beta of "crash the server by sending too much data at once v0.5"?
Re:Xbox live to combat cheating (Score:2)
Re:Xbox live to combat cheating (Score:3, Insightful)
By controlling everything themselves they hope to limit the damage done by those looking for ways to cheat.
Isn't that the exact same approach Microsoft takes to Windows security? They think that if they control the code, no-one with be able to find the holes. Security through obscurity...
Which Is Only Half Of It (Score:5, Insightful)
Aim cheats have nothing to do with server stored data. It all has to do with the fact the classic protocols requires all players in the field to tell all other players in the field their positions in the field. If you can snoop the positions of people then you can calculate an accurate "from the hip" shot with merciless robotic accuracy. If an aim cheat isn't possible, then you can just snoop the data and realize where the other players are hiding and their positing.
The way to beat cheaters is to apply tried and true security practices. Don't trust that the machine on the other end of the connection is really a client(so don't feed it any extra data beyond what it should need to know to function). Don't blindly accept any data coming back from supposed clients(does the client really have "permission" do what it is telling the server to do?).
Protecting the data is a good thing but just like server farms just locking the machines behind a door isn't enough. You have to secure the lines of transmition as well.
Re:Which Is Only Half Of It (Score:3, Insightful)
Imagine how hard it would be for someone to use an aiming cheat or bot in UT if there was a small program that monitored all the scores on a group of servers for cheating. If this program detected someone scoring way out of the norm, an employee of the network could observe the game, see if the guy was really cheating, and then boot him and suspend or cancel his account.
That's just one example, of course, and other cheats may be harder to track (like the one you mentioned about simply knowing where the other players are). I imagine, however, that MS intends to throw a lot of money (and therefore manpower) into this newest of markets. And if they can make cheaters have to deal with a very serious chance of getting their accounts cancelled through good use of human monitoring, I think they'll win the battle.
Re:Which Is Only Half Of It (Score:3, Informative)
This isn't always possible, depending on what type of game it is. The other systems need to know certain information, especially if there is any kind of synchronization going on.
Synchronization is in many ways a good thing, because since each computer does its own calculations individually it really limits what kinds of cheats can be run. You can't make a cheat that boosts your stats becuase your stats will remain normal on my machine, and a desynch will occur the next time your stats effect gameplay.
However in order for synchronization to work just about all data needs to be shared, which makes the data hacks mentioned above possible.
On an RTS i was working on recently it was my job to eliminate the map cheat, whereby the user made the entire map visible, giving them a huge advantage. I did this by having each system report the state of its map to the other players and synchornizing that value. It was still possible to cheat and clear the map, but doing so imemdiatly caused you to be booted from the game.
Although peer to peer is more computationally expensive than client-server models, it does make it easier to control many kinds of cheating.
And on a side note, given some of the other discusions i've seen on this topic, i thought i would mention that both the producers and i agreed that no cheat detection should be used in single player mode. What do we care what you do with the game on your own time? If cheating is the way you enjoy it most, fine with us. When it becomes our problem is when you try to cheat against others online, and ruin _their_ experience, which they have a right to.
How can they do that??? (Score:3, Funny)
Please, Microsoft, give us the freedom to innova... I mean, cheat!
Monty Burns put it best, "Cheating is a gift Man gives himself!"
Re:Xbox live to combat cheating (Score:2, Interesting)
Re:Xbox live to combat cheating (Score:3, Insightful)
More than likely, Microsoft just wants to extract more cash for the games.
As far as frequent backups go, they will NOT be listening to user's requests. No game with a HUGE amount of data is going to listen to ONE customer who gets a "cheater" and needs to restore his data from the previous day, week, whatever. Blizzard runs backups, and the only time they use them is once they've done something and horribly screwed the game up.
There isn't any real way to stop all cheating. I don't think cheating stops people from playing as much as they think. Cheating pisses people off yes, but what about all the flaws that are in the games as they are designed? People camping out spots where monsters respawn and what-not? That's no fun. Less cheating isn't going to make that aspect of the game any better.
Cheaters make games suck...but people will still play a good game with cheaters on it. I played Counter-Strike well after all the cheats starting coming out. Eventually, we'd find a place where there weren't cheaters and have a good time. I didn't bother trying to do that with Tribes 2, even though there weren't any cheaters there. If the game's GOOD people will find a community of other players they can play with and they'll have an enjoyable time. If it isn't, they won't, cheating or no cheating.
In the gamers hands... (Score:2, Interesting)
They stoped cheating, we started playing.
Re:In the gamers hands... (Score:2)
Also, I don't think game developers have taken security into account enough in their games. In the past cheating wasn't a real big deal - you could ruin the game for yourself but not for others. Now, you can ruin a perfectly good 20+ or 1 million+ (diablo 2) game by cheating. Simply put game programmers need to incorporate some type of security systems into their games to prevent this kind of thing.
This sounds like a job for.... (Score:2, Funny)
Re: Bots and Campers... (Score:2, Insightful)
Question. (Score:2, Interesting)
Well, why don't gaming industries today make dongles that have
Re:Question. (Score:2)
Maybe if they made it so you could plug in your USB dongle into another computer and bring your saved settings and stats too....on the computer there's the game engine and graphics, but the data and networking code (and CD-Key) are encrypted onto a USB dongle with a few megs of flash memory. This would not only make it extremely easy to transfer the game between PCs, without actually copying it. As long as you made the host software not care *what* dongle was attached, it'd be a lot easier. Just check the CRC of certain files on it.
I bet we'll see something like this in the future.
Re:Question. (Score:2, Insightful)
Dongle? Huh? (Score:2, Insightful)
You can't stop someone with tampering software on his own (or her own) computer.
Just, basically, dongles suck.
Re:Question. (Score:4, Informative)
A great sound editing software for the Mac was Power Tools. Originally package with a dongle to prevent piracy. The dongle was emulated about 24 hours after the release of the product.
Now though with the cheap USB storage devices hitting the market the concept of dongles might come back. Although the only way to truely secure it would be with a strong cryptographic code to secure both the device itself and the traffic between the device and the software. Althogh you still come down to the fundemental problem that the information is still passing through the users computer and is open to sniffing and cracking.
Securing end client software has always been an extremely difficult problem to solve....
Doesn't solve the problem. (Score:3, Insightful)
(as a side note, all usb devices use more cpu then they should)
You will always be able to reverse engineer the protocol, it will just take more and more effort to do so..
Could encrypt the network packets as you send them, but someone can still patch the binary of the game to inject bad data into them.
Could encrypt the instruction code for the network play, until a valid key is obtained from a server, but then it has to be decrypted sometime, probably ahead of time to be good. Maybe if they implemented a hardware feature where you could give the processor an encryption key, and sent it an encrypted instruction stream, it would decrypt it on the fly. That would be hard to decrypt, unless the attacker were to get ahold of the key, then they could decrypt it.
Any way you look at it, someone, somewhere will be able to figure out a way around it. Social solutions are a much better way to solve the problems of cheating.
Re:Question. (Score:2)
It's a nice idea, but problem is, once someone's program is on your machine, youi can make it do just about whatever you want, supplying you have either the know-how or the tools written by someone else with the know-how.
Autocad used dongles.. and you know how much autocad gets.. 'shared'.
Re:Question. (Score:2)
Um, not exactly. The cracks/cheats would probably not be tied to any specific serial number to work, and all they could do is say "if we catch you cheating, we'll close your account," which they say for many MMORPGs anyway. Otherwise, if they block only by serial, you could just intercept the serial reporting and send a bogus serial to the central servers.
No, having more secure protocols and having the server not tell each client what others nearby are doing (unless they are in sight) is a much better way to go, as mentioned previously in a comment about "aim cheats."
Do something about it? (Score:2, Funny)
edge
"It's all fun and games untill somebody looses a harddrive."
Re:Do something about it? (Score:2)
Console protection is hard, because it's a static target. Cheating prevention is easier, as you have a network connection, and thus can patch the executable in response to cheat attacks.
Public voting (Score:3, Insightful)
This should be taken a step further though. If a cheater has been booted off a server a certain number of times, their cd key should be revoked or temporarily disabled from the master database. Then they won't be able to play online anywhere instead of simply moving to another one of the 1000's of servers.
The problem is this could be abused. People could vote against a player that just happens to be really good, but from all the games I have played the really good players almost never get booted off. It's always the real obvious cheaters that get voted off.
Re:Public voting (Score:4, Interesting)
(of course, this never happens to me; nobody could cheat and still suck so badly)
Perhaps a ranking system. Players of approximately equal skill are pooled together by the server automatically after a certain minimum number of games. Cheaters can then play to their heart's content, but will end up with other cheaters and those who are so good that they can take on cheaters and still live.
Player Respect (Score:2, Interesting)
Re:Public voting (Score:2)
Take EQ as an example. Pretty much, who ever has the largest guild would wield all the power.
Re:Public voting (Score:3)
Re:Public voting (Score:3, Interesting)
I'll take EQ as an example too, but tell you it does work to some extent. I've got some basis to go on here since i am a dev on showeq and host the irc server that #showeq and #eqemu live on.
Currently one can cheat in EQ via playing with memory. The effects you can cause are limited to things like turning off fall damage, no lava damage, unlimited underwater breathing, etc. nothing of too much consequence. With a little extra work, one can teleport to an arbitrary location in zone, and move around quite a bit faster than normal (not the generic speedhack, that will get you banned.)
Previous cheats that were out and semi-widespread among a certain crowd allowed you to do things like using arbitrary skills (even accessing those not available to your class), zoning from anywhere in zone to any zone adjecent to it, permanant sow, removing spells like root, making any number you want show up for
There were more, to varying degrees of impact, but as each was made public, VI was pretty quick to fix it (one member of thier dev team alluding to the site promoting the exploits as a fix-it list).
So i would say in this respect, developers can restrict cheating in mmorpgs.
As for showeq, they change up packets and opcodes quite often, but you always run into the basic problem with trying to hide your data: you have to get it to the client somehow. But even here they have made attempts to curb its usefulness. Over time they've reduced what they send, Hit points are now a % rather than absolute numbers, experience likewise is expresses in 1/330th units, rather than absolute numbers. Faction values are now just an index value so the client knows what to print rather than you actual faction. They are a bit more limited in movement update packets.
They can stop it, but they do a decent job at limiting it.
So while the most powerful guild in a server, does run things, that has absolutly nothing to do with cheating in game.
Re:Public voting (Score:2)
Then the people with the cheats would be ranked "Best" and would only get to play with others that cheat or superhuman players. Maybe the superhuman players (there would be very few of these at this level) would then be able to appeal.
Solving cheating requires closed source! (Score:3, Interesting)
To get around the limits of network connectivity available to vast majority of people developers have to allow the client to render the graphics and interpret the input and then send back the minimum that is needed.
While we all know that open source generally increases security, when you're dealing with people who are trying to abuse features you can't let them know all your secrets. Open source security assumes that the people working together want access to each other, but want to keep others out. The game security model assumes you want to let anyone in, but keep them from doing bad things.
Thus unless you move all potentially abusable functionality to the server side, open source gaming will be limited except for games which tolerate low bandwidth and slow ping times.
Re:Solving cheating requires closed source! (Score:4, Interesting)
At WorldForge [worldforge.org] we have obviously been considering this point since soon after we started, and we believe that this is not the case. It is true that to achieve the twitch responce of a first person shooter it is extremely difficult to detect client side cheating, but the more moderate pace of online RPGs can be different. If a model is chosen where the client is totally untrusted, the players ability to cheat by modifying the source of the client is minimised. An additional benefit is that this security model means it is far more difficult to cheat using add-on programs like those available for many current online RPGs.
Re:Solving cheating requires closed source! (Score:3)
FreeCiv takes the approach of not trusting the clients (all verification is performed in the server; nothing is sent to the client that the user should not know; etc.), and it has excellently playable performance. Of course, it's not a FPS or real-time system. Players do all take their turns simultaneously, though, and it seems to scale up well (max 30 players per game, I think).
Plus, it's a great game!
Re:Solving cheating requires closed source! (Score:2)
Another solution is to limit your games to small networks of players that you trust (the solution in the article's second to last paragraph.)
I'm afraid it may come to this, as cheats can always be made, closed source or not, and with all the virus/trojan/spyware nonsense we see even in legal, commercial products, closed source programs outside video game consoles are going to be trusted less and less.
CS 1.4 (Score:4, Interesting)
The real irony is, wine will not load cheats (as far as I can tell), so people using wine cannot cheat. I had a similar issue with Cheating-Death.
Re:CS 1.4 (Score:5, Insightful)
Re:CS 1.4 (Score:2, Informative)
Re:CS 1.4 (Score:2)
BTW, CS1.5 should be out shortly, im hoping I can play CS under linux again.
Re:CS 1.4 (Score:2)
A perfect world? (Score:5, Insightful)
The bottom line is that there are cheaters in every aspect of life, whether it be real or virtual. Game companies, much like governments, can only do so much. The rest of the problems people just have to live with. Virtual worlds will never be perfect and people will always try and ruin someone else's day.
Re:A perfect world? (Score:2)
Re:A perfect world? (Score:3, Funny)
< sarcasm >
Ah! Obvoiusly a fellow programmer!
<
-
Tao Te Cheating Llama (Score:3, Insightful)
Of course.. the difference between Man and Beast, when you get down to it, is being able to think about things frm someone else's point of view, so when you think about it, this shows you something about the mental state of the organised online cheater.
Even a Chimp can think about something from someone else's perspective...
America's Army (Score:2, Interesting)
As an aside, and I really hate to ask this, I still haven't figured out how to post a root-level comment. I mean, even the First Post-ers and gotse lamers can figure it out, but I'm stumped. Where's the "post comment" button?
Re:Tao Te Cheating Llama (Score:2)
Basics? (Score:3, Insightful)
Sure you can require frequent patches to fill the holes after release. Or maybe require a check-sum of critical files to play. Etc, Etc... But, there will always be people that are willing to figure out ways to by-pass it.
Just like computer security in general. You trade amount of security to functionality.
Heck. I remember when I had snake on Qbasic. I was 6 and had no clue about programming. But, I realized that Player1_Lives = 5 means something and I wanted to change it.. I understand that this is an oversimplified analogy that is completely missing the multiplayer side but, people will always want something for nothing and this is a way they can do it.
Probably the only way to completly secure a game from cheating is to make the client side as thin as possible but, of course the trade off is the server would have to work extremely hard (already a problem now, with server's designed as the thin ware)....
As solution will work itself out eventually.
Social stigma (Score:5, Interesting)
You can boot players, ban IPs, reprimand, close servers, but the miscreants always find a way back in, because its an enjoyable game to them... annoying others.
The only viable solution I've ever come across is the social stigma. This method of self-regulations fails if the game doesn't implement a system of reliance on other players though. As long as several players are needed to band together to achieve certain goals, social stigma works.
Picture a mmorpg where you need 3 other players to help you defeat a certain barrier. There's no other way, its part of the game structure. If you're a cheater, others won't help and you're limited in your game play. Where's the fun now?
Game builders have to be aware that cheaters exist and really strive to construct game play in such a manner where players can self-regulate like that. Admins and code-limitations never seem to solve the real problem.
Re:Social stigma (Score:2, Insightful)
Are you kidding? The cheater will just simulate the two other people via a cheat. But I like the concept.
Bullshit (Score:2, Insightful)
Two words: Cheating Clans.
Many cheaters just don't care about the 'stigmas', but rather relish their negative reputations.
Does policing work? (Score:2)
I understand the example in the article (fighting a guy with twice your stats) perfectly-
I went to a live action role playing event (LAIRE for those who know) and it SUCKED. In the first round of combat, in one hit, the "npc" character completely decimated me. Yes, they were given orders by the GM's not to actually kill anyone.
NOTE: this message is free from any comments regarding Microsoft servers as military grade.
Re:Does policing work? (Score:2)
In theory, your average revenant (I play NERO from time to time) doesn't know a low level guy from a high level guy. They just pick a target and swing 4's. If you have 3 body, you fall down on the first hit.
The dedicated players, who have given way more money to the chapter than you, need to have fun too, and that's typiclly done by giving the players something big to fight.
Also, if LAIRE is anything like NERO, the rule is "don't *killing blow* anybody". Taking that one minute of available healing time away is generally considered a no-no, because once you cross from "bleeding out" to "dead", the cost to make you not dead goes from a level 1 spell to a level 9 spell.
Trolls? (Score:3, Interesting)
It's not just the server but also the data packets (Score:2)
Technology backed social fixes (Score:5, Interesting)
Games with huge numbers of people like EverQuest will suffer from a certain number of bad apples, just like the real world. They're ultimately going to need to rely on policing, technology can't solve everything.
Fortunately, many games don't have huge numbers of players. Quake games peak at a few dozen. Even as small scale games grow, there are practical limits that will keep size down.
There is a partial solution I haven't seen implemented yet: trust networks. To play, you generate a public key and share it with all of the other players. As you play, you mark other players as being friends. (You can also blacklist them, but it's easy for the other person to create a new identity, so it's only a very small part of the solution.) When you mark another player as a friend, your client provides them with a signature proving that you marked them as such. Then based on these networks of trust you can make judgements about who to play with. When you create a game, you might limit it to "my friends, my friends' friends, and 3rd generation friends if they have at least three references from 2nd generation friends." Maybe you leave a spot or two open for anyone to hop in on as a way to make new friends (and if they're a punk, you and your friends can blacklist him quickly).
This will make it harder for truely new people to make initial friends. Many gamers will know at least a few real-life friends who can give them a hand up. For the rest, they'll regrettably have to spend some time learning who they can trust. It's a shame, but it's just like real-life.
There are few details I'm admittedly handwaving (key revokation, special case exceptions), but they're all solvable problems. I'd really like to see a system like them when I play Quake, Half-Life, Diablo II, or Dungeon Siege online.
Re:Technology backed social fixes (Score:3, Funny)
When I played D&D I would just walk into the nearest town, find a place called "Red Dragon Inn", and order a beer. It was never too long before the rest of the adventure team showed up.
Now /that's/ a mature attitude! (Score:5, Funny)
From the article (ya know, that thing you should read before commenting on its contents):
Kick. Ass. I know nothing about this company or their games, but I like them already.
The tables are turned (Score:3, Insightful)
What pisses us all off isn't so much cheaters, as it is deceptive cheaters that try to take advantage or ruin other peoples' fun. Ceating is easy in almost all games where there is any client software at all. I would oppose any game that tried to prevent my use of my computer just like I oppose any os or application that tries to monkey with my computer.
This problem is very difficult to solve because all a player needs to do is outsmart dumb software. That's pretty easy. Everybody knows when someone is using a headshot bot in counterstrike, but it's a little tougher to notice cheaters who pay attention to who is watching and how obvious they are being. I quit playing CS because of cheaters.
Blizzard beat most of the maphack/exploits on StarCraft just by continually patching the software. I think CS and Half-Life should take a hint. Modify the code so that people can't exploit it... often. It's tedious to stack traces for exploitable code, and if the code changes frequently then it becomes very very tedious.
Excellent article from gamasutra about this (Score:3, Informative)
The author needs to check their facts (Score:5, Informative)
Proxy cheats require 2 computers: the one you game on and a proxy that you connect to the server through. The proxy keeps track of what's going on in the game by analyzing the packets that get sent through it. It then makes adjustments (ie aiming corrections) to the packets as they are sent out to the server. This in no way involves breaking into the server.
The common transparency cheats are to a) replace the textures used on the walls with translucent/transparent ones or b) hack your video card's drivers. Neither of those affects the server in any way.
There's a multitude more of these types of cheats. I know because I used to run a decent Half-life and Counterstrike server. I got so depressed at the prevalence of cheating (and cheating accusations), I shut down the server and very rarely play any online games.
Blizzard (Score:2)
The other option (which I use) is to play on closed TCP-IP sessions. Online play for the most part sucks. If the cheating diminishes, the lag exponentially increases (even on my DSL line). Kind of a nasty catch-22.
The simple solution is to sell their damn server code and to stop harassing the open bnet project. However, that would screw them when they (inevitibly) move to a subscription system. Which will suck.
----rhad
This is odd (Score:2)
As a big fan of RTCW, I know PunkBuster is already integrated into the game. Makes you wonder how old this interview is.
Never Trust the Client (Score:3, Insightful)
Don't store any information (encripted or not) on a user's HD or RAM that, if the user were to alter it, would give him an edge. The server should send only what information the client needs to handle the user interaction, and nothing more!
Ask yourself, can an "unofficial" client cheat? If the answer is yes, you have some server-side code to fix.
Accusations (Score:3, Interesting)
The moral of the story? Cheating not only hurts the newbies who want to get into some online games, but also hurts those of us who play often and occasionally show a glimmer of skill.
Re:Accusations (Score:2)
I bet that for every accusation I see probably 10% of them are true, and even fewer have concrete proof of it. I wonder if anyone has been wrongly blacklisted? There's quite some large blacklists out there that are maintained and many servers make use of them. This is probably a real problem with hijacked wonids.
It isn't just the cheaters... (Score:2)
Cheaters and trolls are making it harder for casual users and newbies to get hooked on the on-line versions of games.
If they got rid of cheaters, they'd just be losing an excuse. Hell, I've been accused of cheating when I'm having an "on" night, and I suck. In the end, a player that is playing far over the head of the others on the server can suck the fun out of the game as effectively as one that's cheating. If they are really concerned with playability they'll probably need to come up with some sort of skill rating, as well, so that games will be competitive. That and a killfile ability so you can avoid some of the crap that gets posted to chat by some, without missing the say's from other folks. Actually, a filter that translated variations of "ur momma" to "my momma" would at least make it more entertaining...
One Idea (Score:2)
DMCA (Score:2)
Re:DMCA (Score:2)
DMCA is evil, it will never be used for the common good.
HSX Cheaters (Score:4, Informative)
At the Hollywood Stock Exchange [hsx.com] simulated stock market, there have been problems with cheaters for many years. HSX cheaters - called "manipulators" and "shills" - use information tactics and coordinated buying and selling patterns to dishonestly make HSX dollars.
Internally we have an "SEC", which consists of individuals who seek out cheating patterns in the trading data. We also get suggestions from players as to who may be cheating and how they are able to cheat. HSX Traders that are "guilty" of manipulation are fined according to set procedures [hsx.com].
One of the most interesting cases of cheating was when we received an AIM transcript of real-time cheating behavior. It read like someting out of "Wall Street", except with lots of net slang. We busted them and fined their accounts (after an investigation and due process, of course).
Despite the "threat" that cheating poses to the "civility" of a game community, cheaters and the interesting tactics that they use no doubt make online games more interesting. I often ponder about how to better design game play which can harness the criminal instincts of simulated market manipulators (for the betterment of the game).
As cool as this sounds, I do not think that unleashing 1980's style "media raiders" onto the trading community will ever happen at HSX. HSX trades are transformed into marketing data used by movie production studios, hence requiring us to ensure that game play is fair, and, generally, that trades reflect the real media preferences of HSX traders.
- James
Dump them into a dungeon (Score:4, Interesting)
already been thought of (Score:2, Interesting)
There is only one way to beat them (Score:3, Insightful)
Yes, it's hard, that's why there are so many cheaters and trolls.
If everyone collectively stopped playing when they see a cheater or troll they would go away.
But unfortunately most players cannot tell good players from cheaters, trolls from newbies, and will keep giving the attention the cheaters/trolls want so bad.
There's only one solution (Score:5, Insightful)
And it's the one that the designers of the open source multiplayer action game Netrek [netrek.org] figured out from day 1. You accept that the clients will be compromised, and you design your server and your network model appropriately.
It's only very recently that commercial games developers are even beginning to understand this, and they're still not getting it right. For example, Counterstrike now attempts to check that your opengl.dll is correct. Fine, but that still relies on the client being uncompromised and reporting the correct number. That's a small barrier for a crackers with a hex editor.
They really need to get it through their heads: you can't trust the client. Every packet that comes in has to be assumed to come from a borg or robot client, and dealt with accordingly. What this means in practice is:
This isn't theoretical. I wrote a 'borg client for Netrek (bypassing the pretty darn good RSA binary check that still surpasses that in many commercial games), and found that it gave me at most a marginal advantage. It hardly effected my combat ability at all, and it made only a slight improvement to my strategic ability (by recording the limited information it received and making best guesses about what was actually going on in the game state). It certainly didn't spoil play balance like many FPS hacks do, and it didn't require any server fixes, because I simply could not exploit it very far to start with.
The reason why the Netrek developers understood all this was that it was open source (so it was trivial to hack up a client), and also that servers developers were somewhat separate from the client developers. The server developers could dictate the architecture and packets and the client developers had to work with what they were given. Contrast that with the way that commercial games development tends to get done, with the same people writing both server and client, with a mandate to get it working as quickly and easily as possible.
If I was back in commercial games development, this is the first change I'd make: separate the server developers and client developers, and only let them communicate through the code - and with the server guys calling all the shots. That sounds inefficient, but if you don't make the effort early on, you'll damn well have to do it later, once the problems are out there in the field. We need to fix the attitude endemic in commercial games development that there's never time to do it right, but always time to do it twice.
BNETD, anyone? (Score:3, Insightful)
The point of the oh-so-disputed Bnetd project was
to counter cheats and trolls.
Set up your own server - invite your friends, and
kick out whoever you don't like.
So what M$, Blizzard and the others should do is turn the situation to their advantage,
stop selling server time - sell server software.
The more trolls out there, the more people will want to run their own server.
Supplemental reading (Score:5, Informative)
The ZDNet article is missing the link to my original article [bacarella.com] which is what lead the news.com writer to interview me.
I can see why they left it out though, it calls a lot of the people they interviewed in addition to me names. ;)
My cheating experiences (Score:5, Insightful)
My first online game experinces was on Yahoo Games. It looked interesting: meet new people, have some fun. I was a newbie, and so, went to the newbie area. I a game of cards seemed like fun but was dropped out of the game (lag). When I returned to the server I was chased and verbally harassed (with swears) through 3 other card games. I've never been back... and will never go back.
Sometime later I regained my curiosity and thought I'd try Diablo online. Foolishly I took a high level character (can't remember how high, but had made it to hell difficulty) online and was killed instantly (twice! once in town!). I didn't know anything about 'hacks' then and persisted thinking this was due to server lag (or bugs). Then all of my equipment was stolen after a healing spell was cast on me. No backups, so goodbye all the effort. That was my last Diablo I game online.
The pattern seems to repeat itself with frightening regularity: Quake II: dead, dead, dead and dead again), Unreal Tournament: similar to Quake, Starcraft: rushed (after making no rushing agreements) and had defences repelled by infinite numbers of enemies and attacks that failed even with overwhelming technical and numerical superiority, AOE 2: faced impossible tech advances and armies, Diablo 2: PK'd in no-pk mode. The list goes on.
I make no claims to be an expert player in these games and would have no problem being beaten by a better player -- I find that's often the best way to improve! But, I have taken efforts to use the newbie areas to find other newbies to play with. Unfortunately, cheaters look at these areas as their playground too!
I give up. Too bad, it could have been fun.
they should have thought of this a long time ago.. (Score:3, Informative)
i built the game from day 1 with "how could someone use this to cheat" in mind. if MMORPG developers don't have that mindset their game WILL fail. redundant and flamebait, mod as you wish.
Taking it too serious... (Score:3, Interesting)
When I played Descent 2 on Kali, I used to play against some of the people who had hacks so they could fire two EarthShaker missles at a rate as fast as Gauss cannons. It made me better, and was fun.
Re:Taking it too serious... (Score:4, Insightful)
I understand what you are saying here and I call this "dirty playing" but not cheating. Cheating is running a program / plugin / etc that specifically allows you an advantage. I've never become very good at any online games, though I have tried from time to time, specifically in the Half Life (and mods) areas. When I suspect someone to be cheating I go into spectator mode to see if they are just hella good or if they are walking through walls. When they are walking through walls or making shots that are simply unbelievable (through the wall, through the post behind the wall, straight between the center of the eyes), I give up. I can accept being owned by a better player. I cannot play if I am being owned by a cheater.
And in that case, the odds of me using my personal purchasing power to get another online game? Not gonna happen. Who is left to suffer from this? Well, the cheaters have one less PLAYER to kill and the game companies won't be getting their part of the purchase price from my wallet.
Re:Will those facists stop at nothing? (Score:3, Interesting)
When I buy a game, I'm purchasing the entertainment. If you're on there with autoaimers or speed-up cheats, you're taking my entertainment away.
Re:Will those facists stop at nothing? (Score:3, Interesting)
Re:Will those facists stop at nothing? (Score:2)
Technically no, read you licensing agreement. Strike 1.
That doesn't mean that they can come back later and take away my rights, like the right to cheat
No such right existed. However cheat all you want on your system in your single player environment or in a LAN environment with your buddies who know what you are doing, but when you connect to a public server you are bound by a terms of use in order to access that server. Strike 2.
Re:Trolls (Score:2)
Re:Trolls? (Score:2)
- Shooting teammates when friendly fire is on
- Shooting hostages no matter which team you are on
- Having the bomb and not planting it
- Repeatedly start and stop defusing the bomb when your teammates are waiting on you
- Get a friend to play for the other team, hang back until you are the only two players left and then run around and don't kill each other but pretend to knife fight and waste everyone's time
There are many ways to ruin such a game without cheating. These are also difficult to address from a developers perspective.
MOHAA trolls (Score:3, Interesting)
One of the most realistic ways to play MOHAA is with friendly fire on -- you have to know where you're chucking grenades and so on. However, it's nearly impossible because trolls will kill most of the team right at the spawn point. Some trolls block tight passageways or just play obnoxiously. In a full 8-user server, two trolls on one team can shift the balance of power so far its just not any fun.
Then there are cheat trolls that combine cheats with trolling behavior (noclipping under the road and killing people, for example) to be seriously obnoxious.
I don't know how you combat this, really. I think the best way would be enabling a kickban command that would kick a user from the server and then ban their IP, username, or both for a specified period of time. Banning IP blocks might be an option as well.
I know, I know, NAT, DHCP pools, etc etc will lessen the effectiveness of such techniques, but if you make it just annoying enough to troll people might stop and go back to making prank phonecalls or whatever they did before they messed with games.
Re:MOHAA trolls (Score:2)
I've seen several different ways to handle this on various FF CS servers.
One way is if you kill a teammate, you insta-die at the start of the next round. Another way is if you kill more than X teammates, you get kicked, or kbanned for a period of time. Another way is mirror-damage, where if you inflict 25 points of damage on a teammate, your health is reduced by 25 points.
FF CS servers that use none of these methods are unplayable because of TKers. But any one of them generally keeps things under control, unless you get a very determined asshole. Then it's simple matter for the rest of your team to take turns fragging him at the start of each round.
Distinguishing trolls from bona fide newbies? (Score:3, Insightful)
Another way is if you kill more than X teammates, you get kicked, or kbanned for a period of time.
Then how will people who just bought a copy of the game yesterday and don't yet have full control of their input devices be able to play? How do we distinguish trolls from legitimate newbies?
Re:Slashdot hypocrisy (Score:3, Insightful)
TV Network cracking down on Tivo commercial skipping: bad
Microsoft cracking down on security hole advertisers: bad
AT&T cracking down on cable theft: bad
Game developers cracking down on cheating: good
To summarize:
Minority restricting a majority: bad
Majority protecting itself from minority: good.
Re:What about open source and cheating? (Score:3, Informative)
Re:They need to (Score:5, Insightful)
That works real well until you realized that many players cheat by unfairly reading information with a different application or proxy.
A good example of this is the 'aiming' proxy, which is a proxy application that sits between your FPS client and the server. The proxy parses the packets sent beteen client and server. Since the client is responsible for telling the server what actions you make and the server is responsible for telling the client what all the other players are doing, the proxy applies a little bit of math to the two pieces of information and 'corrects' your shot so that it hits another player despite where you really aimed.
Unless your game can somehow telepathically guess where the players are, there's no real way to hide this information from the client. Encryption strong enough to prevent a reasonable crack is too math intensive to run at the same time, meaning that hard encryption just isn't the answer.
There are apps out there for all the FPS servers that attempt to detect this sort of thing, but most of them work by checking ratios. If you happen to get luck and exceed the ratio of possible good shots to bad shots, you're tagged as a cheater.
If you can read the client-server data stream, you can cheat.
That's why the answer to cheaters lies not only in designing applications to prevent cheating, but allowing players to flag cheaters and bump them from the game.
In MMOG's, this means that GM's should respond quickly, intelligently, and decisively to player complaints. In smaller scale actions, players should always have a 'cheater' button that allows them to collectively police the game by booting and banning malicious players.