The State of Cheating in Online Games

Gary Mullins writes "GameApex has a nice article up meant to inform other gamers about the presence of cheating in online games. The article covers the types of cheats to be aware of, the type of person the average cheater is, and even includes plenty of information from anti-cheat experts from PunksBusted, United Admins, and The Cheat Police." From the article: "If recording a demo is not an option then you can always use screenshots. While these are not as effective they do work. Once reviewed by you, if you do suspect the player is cheating, forward the information to the server admin. This information is always in the listing of the server or even in scrolling messages on the server in-game. Speaking as someone who has been a server admin, when you have a player who you suspect is too good to be true make sure you check them out before immediately kick or ban them. Sometimes it is better to err on the side of caution and presume the player is skilled, than to assume they are cheating. If they really are cheating it will be proven sooner or later anyway."

Admining Game Servers

[g0bshiTe]

I am a server admin for an FPS clan, we span mulitple games and have several servers. During my time admining, I have actually downloaded and used several of the more popular cheats for the games that I play, in an effort to 1) see what I am up against 2) learn what to look for in a suspected cheat 3) check the effectiveness of our anti cheat programs. A few things I have learned that I can pass on to other server admins. 1) Punkbuster does not work! I have gotten cheats into Punkbuster enabled servers that I admin, without having my IP on any protected list. 2) You can spend 80% of your time specking people who are suspected of cheating, or you can use a cheat as a tool to help you admin. On several occasions while playing someone would make a remark about a cheat, and you go to spec, and something looks odd but the player does not seem to be cheating, you play a little more, still you are unsure about that player, so you load up a hack and spec them while you have a hack on. I have spotted several hackers without shadow of doubt using this method and spotted them in less then 5 mins. Usually after a ban this theory is confirmed by one of two things, the server either crashes shortly afterward, or they try to come back using a name like Fuckers_Ban_Me_You_Faggotts. I have found this typical of hackers in games. On most occasions I tend to err on the side of they are skilled, as I have to exit my game to install my cheat then reenter the game, this way I am not tempted to use the cheat while playing. I would much rather get a decent score from my ability than a cheat.

subjectiveness in demos or screenshots

[pxuongl]

i used to play sof2 quite religiously, and at some point, got extremely good at it. And eventually, got kicked and banned from just about every server. for one server in particular, i decided to take a stand and try to get myself unbanned. i was initially banned for cheating because i had a score of 120-5 or something like that. so from there started a long series of forum debates while i was trying to unban myself. it ended up, as i found out, that half the admins there thought i was cheating, and had demos to back their claims. and then the other half thought i wasn't cheating, using their own set of demos and also by pointing out things in the demos that alleged i was cheating. in truth, there is a lot of subjectivity for very skilled players when viewing a demo and trying to determine whether or not the person really is that good, or if they've got an aimbot, wallhack, or some other type of hack. long story short, after a month's worth of fighting, they unbanned me, and let me back on the server. from there, i was recruited into a competitive clan, and participated regularly in tournaments that the server group would hold. and then i was eventually banned again by an admin who was new to the servers and his powers... claiming that i was too good to be true, despite the rest of the community saying otherwise. the fun part is that of all the players on the servers who would accuse left and right as soon as they get killed by the same person a few times, i noticed that it was always the good players who never cared if somebody was cheating or not. if a person was cheating, the skilled would find a way to play around it, or just simply leave. and what was left were the whiners and complainers. so i'm rambling on a bit... but just screenshots and even demos along aren't enough to distinguish between a really skilled player and a cheating player. the differences are often very subtle. but what you end up having to look for are mistakes, if things are repeated, etc... but even then, those things can be completely human, but appear to be due to a bot. in the end, i believe it's the community and relationship each player builds with a server's admins that's way way way above demos and screenshots alone. an ungodly good player with a good attitude are rarities that keep people coming back to a server or game. the ungodly good players with bad attitudes are what kill servers and kill games. so despite it all, i believe it's ultimately up to the types of people a game attracts, the friendliness and supportiveness of the community, and the fairness and levelheadedness of it's admins that will trump any cheater.

Stupid game design

[Spazmania]

Another example is from Call of Duty there was a flaw with running MSN Messenger that would allow you to see through walls and other textured areas of the levels.

Okay, for any game designers who have been hiding under a rock for the past decade (which sadly seems like a lot of them) here's online game design rule #1:

If the player's computer knows something, expect that the player knows it too. If you design the game so that the player's computer knows something before the player should then you are practically begging cheaters to ruin the game.

And rule #2 is probably that anything which depends heavily on the player's dexterity begs for cheaters as well. "Aimbots" is the cited example -- cheat programs that aim for you. You can't actually prevent this. Code integrity checks? Fine, intercept the driver. Driver integrity checks? Fine, run it in a virtual machine and run the bot outside of the vm.

Seriously, complaining about this and calling folks cheaters is like dropping $20 on the street and complaining about thieves when you go back and find it gone. Of course its gone. Duh.

Solutions?

[JetFox]

A lot of talk about what people are doing, and very little on what can be done to prevent this. One of the few solutions mentioned is that: "Unfortunately, getting rid of cheaters completely will not be done until the server holds all of the game files."
Which seems unlikely for a very large game. Unless you want to reacquire the game everytime you play. The "state of cheating" in all aspects of life is visible, and unless a paradigm shift of society occurs, the same exploits or hacks will be made.
How about stricter punishment (perhaps permanent bans?) to those that cheat?

They will break in somehow...

[garylian]

No matter what the game companies do, people that desire to cheat are going to break through, sooner or later. And usually sooner.

I remember when SOE decided to update their encryption on the server-client transactions to defeat ShowEQ. ShowEQ was a packet sniffing application that people would run on a Linux box, and it would supply area maps, mob info, etc. (The plane of Hate had a few invisible, untargetable mobs that were named "ShowEQ Users Suck". Only people who used it or knew about the program knew about those mobs.)

SOE went to either a 64-bit or 128-bit encryption with this new version, and were changing it with every client patch. They figured they had quite a bit of time on their hands, and ShowEQ would be disabled for quite some time.

I do believe they hacked the encryption in 2 days, and really less than 24hrs. And the coders for ShowEQ made it so you could put a .dll on your machine (and everyone named it differently so SOE couldn't detect a common name) that would pass the encryption code to the Linux machine.

All they did was increase the entrance requirements, which had become a joke. At one point, to use ShowEQ, you had to know enough to set up a Linux box, compile the ShowEQ programs from source, and keep it updated with each patch. Then folks started to sell pre-installed Linux boxes that auto-updated themselves, auto-compiled the program, and there was only a dollar amount entry fee. SOE took that back, but the smart people kept on going.

Mind you, ShowEQ really wasn't THAT great. The biggest thing was having maps for zones that you couldn't have in-game maps for. Once SOE gave us a mapping function for all but a few zones, it wasn't worth keeping updated. But people still did it, and other folks complained about the competitive disadvantage of maps.

So, people will find a way, and use it. Heck, there were people out there wanting to use Sony's flawed DRM stuff to hide hacks from Blizzard. 'Nuff said.

Re:Stupid game design

[pxuongl]

dirty little secret: i used to cheat on yahoo chess by loading up chessmaster and setting it to the highest levels.

case in point: the human mind is far more creative than a group of programmers and any computer algorithm they can devise - and as long as that is true, then there will always be a way to cheat.

Re:Punkbuster

[Avillia]

I don't know whether this is sarcasm or a joke: I really don't see or feel like there are many cheaters in BF2.

There's just cheapass stuff at every turn like spawn-raping, armor-whoring, the recently-nerfed PKM sniping...

However, there is, of course, the fact that PunkBuster and their own anti-cheating methods DO slow the game down. A LOT.

You know where it says 'Verifying Files' for about a half hour before you get in game?

That's PB religiously checking every bit of the 1-2 gigs of memory that is recommended for BF2 for cheats, every game file for MD5, etc etc. HD Intensive RAM Intensive. Try playing Single Player and then compare that File Verification to a live server.

Re:Stupid game design

[MachDelta]

If you design the game so that the player's computer knows something before the player should then you are practically begging cheaters to ruin the game.

Unfortunatly its not always that black and white. Due to the nature of networked gameplay, its often very helpful that the client is given data in advance of an event appearing on-screen. Otherwise everything you "see" has the front end clipped off (eg: players appearing out of nowhere) because of latency. Most modern real-time networked games are one big charade of interpolation anyways, so when you starve the client of data weird things will happen.

Its a horrible ballance between making a good looking, good playing game, and trying to protect your creation from the asshats of society.

Re:Stupid game design

[Impotent_Emperor]

You could run the chess program on a second computer. Let's see them scan that!