ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+...
Transcript of ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+...
![Page 1: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/1.jpg)
ANTI-CHEAT FOR MULTIPLAYER GAMES
Simon Allaeys, Aarni Rautava
![Page 2: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/2.jpg)
2006
Hobby project
Third-party CS anti-cheat
2013 - Today
25+ online multiplayer games worldwide
Team of 14 based in Helsinki, Finland
Actively researching the domain
Who we are
![Page 3: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/3.jpg)
Questions Answered
What is cheating?
Who is doing it?
How is it done?
Anti-cheating?
![Page 4: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/4.jpg)
CHEATING
(╯°□°)╯︵┻━┻
![Page 5: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/5.jpg)
Cheating?
Gaining anunfair advantage
![Page 6: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/6.jpg)
![Page 7: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/7.jpg)
Cheating?
Exploits Automation State ManipulationOverlays
![Page 8: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/8.jpg)
Great game!
![Page 9: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/9.jpg)
Game
Great game!
![Page 10: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/10.jpg)
Game
Great game!Re-invest
New
Development
Re-invest
![Page 11: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/11.jpg)
Game
Great game!Re-invest
New
Development
Re-invest
![Page 12: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/12.jpg)
CHEATERS
(╯°□°)╯︵(\ .O.)\
![Page 13: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/13.jpg)
Who are they?Some definitions
HACKERS PROVIDERS CHEATERSR&D
Loader/Injector
Features
DRM
Branding
Community
Payments
Localization
Players / Users
![Page 14: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/14.jpg)
HACKERS PROVIDERS CHEATERS
Follower
Vigilante
Griefer
CasualAchiever
![Page 15: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/15.jpg)
HACKERS PROVIDERS CHEATERS
Scripters Senior Researcher
![Page 16: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/16.jpg)
HACKERS PROVIDERS CHEATERS
Open Communities
Free cheats
Easy access
Knowledge sharing
Cheat Publishers
Paid cheats
Easy access
Closed Communities
Private cheats
Reputation based access
Limited availability
![Page 17: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/17.jpg)
It’s a businessCheating as an industry
Free public cheats
Public commercial cheats
Paid private cheats
Private exclusive cheats
Legitimate businesses
Registered companies
Tax payments
Professional management
One Person Company
… - $750k a year - …
Teams
… - $1.5M a year - …
Global market size?
> $100M
![Page 18: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/18.jpg)
CHEATS
ლ(▀̿̿ Ĺ̯̿̿ ▀̿̿ ლ)
![Page 19: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/19.jpg)
Exploits and scriptsEveryone has done it
In-game glitching
Console variables and game options
Game debug console
File modding
Enforce valid variable values
Exclude debug options from releases
Check game files integrity
![Page 20: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/20.jpg)
..downloaded a toolGame manipulation
Poking around..
Game state manipulation
Authoritative game servers
Obfuscation and encryption
Anti-cheat prevention or detection
![Page 21: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/21.jpg)
Cheat v0.1Writing your own cheat
Open source cheat examples
Documented game engine dependencies
• Hijack dependencies
Documented game engine interfaces
• Hack as a plugin
![Page 22: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/22.jpg)
Cheat v0.1Writing your own cheat
Open source cheat examples
Documented game engine dependencies
• Hijack dependencies
Documented game engine interfaces
• Hack as a plugin
Tom
[USP]Mike
[Deagle]
![Page 23: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/23.jpg)
Bot v0.1Writing your own bot
Open source bot examples
Automated player input
Plain text protocol?
Farm, farm, farm…. profit!
![Page 24: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/24.jpg)
![Page 25: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/25.jpg)
Cheat v1.0Feature rich cheats
Inject Cheat Features
Inline code patches
Interface pointer hooks
Hijacking exception handling
Hardware debug breakpoints
…
![Page 26: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/26.jpg)
Cheat v1.0Feature rich cheats
Inject Cheat Features
Inline code patches
Interface pointer hooks
Hijacking exception handling
Hardware debug breakpoints
…
Protect the cheat itself
DKOM (Hiding processes, drivers, ..)
Interrupt hooks
System service hooks (NTAPI)
VAD hiding (Hiding cheat memory)
…
DRM, hardware locking, monitor usage
![Page 27: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/27.jpg)
Cheat v4.0Hacking as profession
Modular, well designed software
Strong knowledge of OS internals
Hidden deep in kernel, no traces
DRM protected
![Page 28: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/28.jpg)
ANTI-CHEATING
┬──┬ノ( ゜-゜ノ)
![Page 29: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/29.jpg)
![Page 30: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/30.jpg)
Anti-cheat StrategiesWhy not cheat?
Ris
k
Re
wa
rdPerceived
Cost
Perceived
Value
![Page 31: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/31.jpg)
Reduced RewardDecrease value of cheating
Anti-cheat by design
Authoritative game server
![Page 32: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/32.jpg)
Reduced RewardDecrease value of cheating
Anti-cheat by design
Authoritative game server
Game Mechanics
![Page 33: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/33.jpg)
Increased RiskGrow cost incurred from cheating
Game price
![Page 34: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/34.jpg)
Increased RiskGrow cost incurred from cheating
Game price
Account value
!
ICheatReportingService
ReportPlayerCheating
RequestPlayerGameBan
GetCheatingReports
RequestVacStatusForUser
ReportCheatData
![Page 35: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/35.jpg)
Increased RiskGrow cost incurred from cheating
Game price
Account value
Ranked matchmakingand tiered gameplay
![Page 36: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/36.jpg)
Increased RiskGrow cost incurred from cheating
Game price
Account value
Ranked matchmakingand tiered gameplay
Reduced supply inflates cheat price
![Page 37: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/37.jpg)
ANTI-CHEAT AS A SERVICE
┬──┬ノ( ゜-゜ノ)
![Page 38: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/38.jpg)
Anti-Cheat ServicesRaising the bar for cheating
Detect cheatsstatistics vs signature vs heuristic
![Page 39: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/39.jpg)
Anti-Cheat ServicesRaising the bar for cheating
Detect cheatsstatistics vs signature vs heuristic
Discover cheatsreporting vs manual vs
automated
![Page 40: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/40.jpg)
Anti-Cheat ServicesRaising the bar for cheating
Detect cheatsstatistics vs signature vs heuristic
Discover cheatsreporting vs manual vs
automatedPrevent cheats
code obfuscation vs sandbox
![Page 41: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/41.jpg)
Anti-Cheat ServicesRaising the bar for cheating
Detect cheatsstatistics vs signature vs heuristic
Discover cheatsreporting vs manual vs
automatedPrevent cheats
code obfuscation vs sandbox
Ship updatesgame updates vs independent
![Page 42: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/42.jpg)
Doing it yourself?Some quick advice
Protect company assets
Machine isolation
Network isolation
VPN
Protect sensitive information
Gmail, Skype, Outlook
Payment data
Source code
Scope, allocate
It never ends
![Page 43: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/43.jpg)
STAYING IN CONTROL(づ。◕‿‿◕。)づ
![Page 44: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/44.jpg)
What to do?Staying in control
Community management
Plan ahead
Disconnect
![Page 45: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/45.jpg)
What to do?Community management
Community management
Plan ahead
Disconnect
Acknowledge and show commitment
Avoid added publicity for cheating
No promises or claims
Keep the focus on game content
![Page 46: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/46.jpg)
What to do?Plan ahead
Community management
Plan ahead
Disconnect
During early design phases
Trust client as little as possible
React quick to exploits
![Page 47: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/47.jpg)
What to do?Disconnect
Community management
Plan ahead
Disconnect
Don’t engage in warfare
Separate the people from the problem
Isolated task force team
Don’t underestimate
Cheating is not solved overnight
![Page 48: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/48.jpg)
![Page 49: ANTI-CHEAT FOR MULTIPLAYER GAMES · 2006 Hobby project Third-party CS anti-cheat 2013 - Today 25+ online multiplayer games worldwide Team of 14 based in Helsinki, Finland Actively](https://reader033.fdocuments.net/reader033/viewer/2022052007/601c68c545fc246a1d49a712/html5/thumbnails/49.jpg)