Valve Anti-Cheat

From Wikipedia, the free encyclopedia

Valve Anti-Cheat, abbreviated to VAC, is a proprietary anti-cheat solution developed and maintained by Valve Corporation as a component of the Steam platform. Although predating Steam, VAC has been fully adapted to its network and, since the release of VAC2, has seen considerable success in the constant battle against cheating in online games.

VAC was first released with Counter-Strike 1.4 in 2002,^[1] following Valve's decision to forego PunkBuster in preference of a proprietary system. The initial version, VAC1, saw success for a period, but in March or April 2004 updates ran dry as the Valve engineers maintaining it moved on to the production of its successor, VAC2. VAC1 swiftly became all but useless during this period of development, but since its 20 June 2005 launch VAC2 has successfully overseen a precipitous decline in the number of cheating players across all games "protected" by it.

VAC2 theoretically supports all games, and has today been implemented in GoldSrc, Source, and Unreal Engine 2 titles. It is included in the Steam SDK for licensees.

Contents 1 Advantages 2 Disadvantages 3 Successes 3.1 Polymorphism 4 Delayed bans, criticism & rationale 4.1 False-positive detections 4.1.1 X-Spectate 5 See also 6 References

[edit] Advantages

• Total integration through Steam.
• Use of the Steam framework for any update tasks.
• "Delayed ban" system denies cheat producers of accurate and timely information.
• As of VAC2, client-side updates are usually not required to detect new cheats,^[2] again denying cheat producers information.

[edit] Disadvantages

• Cheats need to be individually found and added to the VAC database.^{[citation needed]}

[edit] Successes

On June 20, 2006, a prominent cheat distributing source "informed the top cheat distributing sites to mark all cheats as [VAC] detected until further notice", citing VAC's hash matching as the reason why cheat users were routinely and frequently receiving bans, even though the VAC code on client computers had not been altered for some months.^[2] There have been no publicly acknowledged breakthroughs in circumventing VAC's protection since, although private cheats still exist for the few who have access to them.

On November 17, 2006, Valve announced that "new [VAC] technology" had caught "over 10,000" cheating attempts in the preceding week alone,^[3] the first real indication of the scale of anti-cheat operations. It should be noted that not all of the accounts banned would have contained legitimate, purchased games, and also that there is no external audit on the figure.

[edit] Polymorphism

More recently, cheat writers have used polymorphism, a technique common among virus writers that sees the compiled code change its internal structure – and thus its hash – in an unpredictable manner with each execution.

However, such techniques can require some very specific technical knowledge and so far relatively few polymorphic cheats have been produced. Valve's response to polymorphism is unknown at this time.

[edit] Delayed bans, criticism & rationale

VAC2's motives are often called into question due to its 'delayed ban' system. When a user connects to a secure server their system memory is scanned at any number of random points for cheats (the precise manner in which cheats are detected is secret). If a cheat is found, the player's Steam account will be flagged as cheating, but the player will not be banned nor receive any indication that they have been detected. It is only after a certain, variable delay, roughly three days for VAC1 and officially less than three weeks for VAC2,^[4] that the account is permanently barred from "VAC Secure" servers^[5][6] across a relevant set of games (e.g. Valve's Source games, GoldSrc games, Unreal games).^[7] VAC1 originally banned for five years,^{[citation needed]} and later one year:^{[citation needed]} these bans were 'grandfathered' in and expired on their original date.^{[citation needed]}

Valve's reasoning behind the system is that it makes it harder for cheaters to tell if the cheat is 'VAC-Proof' or not.^{[citation needed]} They claim that in the time it takes from the cheat being detected to the first banning, many more cheaters will have been caught than had it banned the first person on the spot and allowed the alarm to be raised immediately. Critics claim however that this gives cheaters a counter-productive 'grace period' where they can freely cheat with no repercussions.^{[citation needed]} Others charge the system (delayed bans or not) with existing to make Valve money,^{[citation needed]} on the basis that cheaters will buy another copy of the game in order to continue cheating rather than desist. While it is not unknown for cheaters to steal copies from shops in order to do this, the purchasing of new ones has only been reliably observed in those caught and reformed, mainly through their apologetic posts on the Steam User Forums.^{[citation needed]}

[edit] False-positive detections

Those that have been caught by the system also criticise it, usually with the claim that it has made a false positive. The only recorded instances of false positive have been under VAC1:

• Immediately after VAC's release, memory corruption (corruption of the physical memory used by the game modules caused by bad RAM or misbehaving processes) would lead to a VAC ban.^{[citation needed]} When this problem came to light, VAC was altered so that corrupted memory would only lead to a kick from the server and all bans due to this were reversed.
• In 2002, joining secure servers while running under the WineX Windows emulator for Linux led to a VAC1 ban. ^[8] The bans were shortly reversed and the issue reduced to WineX players merely being kicked from secure servers, but the incompatibility was only fully resolved - allowing Linux players to connect to VAC-protected servers - a year later. ^[9]
• During the early stages of VAC1's life, detections were generic enough to allow non-cheat applications to trigger a ban if they behaved in similar ways to cheats or contained similar code. This led to bans triggered by acts other than cheating.^{[citation needed]} VAC's detection methods became a lot less generic after the problem came to light when players were banned for using a Winamp integration program called HLAmp. When this change was made, every existing VAC ban was removed in order to account for players banned due to other, unknown, non-cheat programs.^{[citation needed]}
• In 2003 VAC1 detected the in-game MP3 player HLamp as a cheat. ^[10] The mistake and its effects were reverted within five hours of the first HLamp users receiving their bans.
• An apparent server-side glitch on 1 April 2004 led to a glut of arbitrary VAC1 bans. All were reverted within an hour of the problem arising. ^[11]

VAC2's hash detection methods make false positives such as these extremely improbable, but slow the detection process by requiring cheats to be individually identified.

[edit] X-Spectate

In June 2006,^{[citation needed]} VAC2 began banning players for the use of X-Spectate, an anti-cheat tool that gave users a wallhack effect when, and only when, spectating or watching a demo. Valve had never publicly endorsed X-Spectate, but conversely had refrained from adding it to VAC and VAC2's lists of cheat signatures in the two years since its release. In the few days after players started being banned for using the tool, Valve downgraded VAC2's response to merely kicking players from servers, rather than banning them. Players that had been banned for using X-Spectate had their bans reversed after submitting a Steam support ticket.^[12]

There is some debate as to whether this counts as a false positive detection or not, as the definition of a cheat contained in the Steam subscriber agreement does not cover tools such as X-Spectate. The program's author maintains that it is not a cheat as it does not give the "unfair competitive advantage" required by Valve's definition.

[edit] See also

• Cheating in online games
• Cheating in Counter-Strike
• Punkbuster
• Steam (content delivery)

[edit] References