Cheating in online games

Cheating in online games is an activity that modifies the game experience to give one player an advantage over others. Depending on the game, different activities constitute cheating and it is either a matter of game policy or consensus opinion as to whether a particular activity is considered to be cheating. Johan Huizinga defines cheating as the action of pretending to obey the rules of the game, while secretly subverting them to gain advantage over an opponent.^[1]

Cheating reportedly exists in most multiplayer online games, but it is difficult to measure.^[2] The Internet and darknets can provide players with the methodology necessary to cheat in online games, sometimes in return for a price.

Mods

Mods are modifications to games that are intended to change the gameplay experience. Sometimes, mods are intended to give players an advantage over other players who are not using mods.

Bots and software assistance

Aimbots and triggerbots

An aimbot (sometimes called "auto-aim") is a type of computer game bot used in multiplayer first-person shooter games to provide varying levels of automated target acquisition to the player. While most common in first person shooter games, they exist in other game types and are sometimes used colloquially with a TriggerBot, which shoots automatically when an opponent appears within the field-of-view or aiming reticule of the player.

Aimbotting relies on the fact that each player's client computer receives information about all the other players, whether they are visible from the player's position on the playing field or not. Targeting is simply a matter of determining the location of any opponent relative to the player's location and pointing the player's weapon at the target. This targeting works regardless of whether the opponent is behind walls or too far away to be seen directly. If the game being played allows bullets to penetrate surfaces with reduced damage (such as later games in the Call of Duty franchise), the code can be manipulated to cause the bullets to penetrate an infinite amount of material and damage can be adjusted to guarantee a kill regardless of where the bullet lands. This severely magnifies the unfair advantage the aimbot would provide. Some aimbots also use a strategy of "you shot first": they would know where you are and run right past a player and wait for a player to shoot at them then spin around and kill the player.

Some servers allow inactive players to spectate, watching the game from the viewpoints of the active players. Recording of gameplay actions is also often possible. If someone was using a targeting aimbot, the bot would be plainly obvious to the spectator as unnatural exact position tracking. Certain aimbots attempt to hide this obvious target selection by using a technique called "Silent Aim" which is mainly used in Call of Duty games. By using this method, aimbots are able to target and kill enemies without showing the tracking of traditional aimbots. Some aimbots and triggerbots are blatant while others attempt to hide from spectators the fact they are being used through a number of methods, such as delaying firing to hide the fact it shoots the instant an opponent is in the cheater's crosshair. Some Triggerbot programs can be easily toggled on and off using the mouse or keyboard.

Aimbots are not to be confused with Aim-Assist that game developers have controversially incorporated into games (Halo and Call of Duty franchise games have baked in aim assist). Aimbots are different because they tend to work with 3rd party code on a number of different parameters from what Aim-Assist uses to function. Aim-Assist is typically included with intent to assist a player not with target acquisition, but target tracking. This tactic is very popular among console game developers because of the inherent lack of precision with the analog stick on the authorized controllers. The larger (or louder) controversy is when developers allow for aim-assist on PC games where the precise mouse is already available, many PC gamers feel "cheated" that the "hack" is in the game.

As above, aimbots can be readily apparent when people use them, and they can be refined, but some have chosen to pursue different mechanics in the name of stealth. In the last few years, 3rd party code that replicates Aim-Assist as seen in those games, but with the purpose of applying them as a cheat for games that do not include Aim-Assist as a native feature (such as the Counter Strike franchise on PC). Even on websites the distributors of such cheats make the distinction of Aim-Assist from aimbots because the cheat performs a specific action.

It is worth noting, however, that some cheat programs are a suite of many different features, incorporating many or all of the above as well as including options for ESP and other cheats such as affecting player movespeed, ammocount, always-on radar or enemies on map, etc, and such a suite can be colloquially called an "aimbot program", much the way Kleenex has become a common word for all tissue paper.

Artificial lag

In the peer-to-peer gaming model, lagging is what happens when the stream of data between one or more players gets slowed or interrupted, causing movement to stutter and making opponents appear to behave erratically. By using a lag switch, a player is able to disrupt upload from the client to the server, while their own client queues up the actions performed. The goal is to gain advantage over another player without reciprocation; opponents slow down or stop moving, allowing the lag switch user to easily outmaneuver them. From the opponent's perspective, the player using the device may appear to be teleporting, invisible or invincible, while the opponents suffer delayed animations and fast-forwarded game play, delivered in bursts.^[3] Some gaming communities refer to this method as "tapping" which refers to the users "tapping" on and off their internet connection to create the lag.

The term "lag switch" encompasses many methods of disrupting the network communication between a client and its server. One method is by attaching a physical device, called a hardware lag switch, to a standard Ethernet cable. By flipping the switch on and off, the physical connection between the client and the server is disrupted. The designers of video game console hardware have started to introduce built-in protection against lag switches in the form of voltage detectors, which detect a change in voltage when the switch is flipped. Some manufacturers have taken counter measures to bypass or trick this detector.^[4] This can also be achieved by simply unplugging the Ethernet cord going to the client, causing a disruption in the player's internet connection. Other methods, called a software or wireless lag switch, involve using a computer program. In this method, the cheater runs an application on a computer connected to the same network as the client. The application hogs the network bandwidth, disrupting the communication between the client and its server. However, one cannot do this for an unlimited amount of time. At some point, if no traffic is being received, most game clients and/or game servers will decide that the connection has been lost and will remove the player from the game.

In the peer-to-peer gaming model, lagging refers to a player with a faster connection flooding an opponent(s) using a basic denial-of-service attack outside the game structure.

Look-ahead

Look-ahead cheating is a method of cheating within a peer-to-peer multiplayer gaming architecture where the cheating client gains an unfair advantage by delaying his actions to see what other players do before announcing its own action.^[5]

A client can cheat using this method by acting as if it is suffering from high latency; the outgoing packet is forged by attaching a time-stamp that is prior to the actual moment the packet is sent, thereby fooling other clients into thinking that the action was sent at the correct time, but was delayed in arrival. A partial solution is the lockstep protocol.

Maphacking

Maphack is a generic term that refers to a method or third-party program that enables a user to see more of a level than intended by the developer. A maphacker is a user that deliberately executes such a method or program in the context of a relevant game, whilst maphacking is the act of such.

A common aspect of real-time strategy games is the player's partial limitation or complete inability to see beyond the visibility range of individual game objects that are under their ownership (typically units and structures); this concept is controlled by a mechanism known as the fog of war. Maphacking usually enables the user to bypass this mechanism, either by removing it entirely and/or by rendering objects through the fog that would not normally be visible. In multiplayer modes, this allows for a distinct advantage against the other players who are subject to the intended settings. The advantage gained can be substantial, especially for the average real-time strategy games that rely on the rock-paper-scissors dynamic to balance out individual objects' varying strengths and weaknesses. Also called "chams" or "wallhacks" in most FPS games (such as Cross Fire, Team Fortress 2, and Call of Duty, to name a few) it can enable users to see "through" a wall, the outline of said player is generally seen in a gamma-intensive outline, such as neon greens, blues, reds, extremes (white/black), and pinks. Users can usually set what color to choose.

Wallhacking

Wallhacking allows a player to see through solid or opaque objects and/or manipulate or remove textures, to know in advance when an opponent is about to come into targeting range from an occluded area. This can be done by making wall textures transparent, or modifying the game maps to insert polygonal holes into otherwise solid walls.

As with the aimbot, wallhacking relies on the fact that an FPS server usually sends raw positional information for all players in the game, and leaves it up to the client's 3D renderer to hide opponents behind walls, in plant foliage, or in dark shadows. If the game map rendering could be turned off completely, all players could be seen moving around in what appears to be empty space. Complete map hiding offers no advantage to a cheater as they would be unable to navigate the invisible map pathways and obstacles. However if only certain surfaces are made transparent or removed, this leaves just enough of an outline of the world to allow the cheater still to navigate it easily. Wallhacking is more widely used than aimbot as it provides an almost undetectable consistent hack, it is also much more dependable as in you will know where every player is before and can pre-aim or pre-fire and would not give constant headshots and would look less like a bot, it is well known in such games as Halo and the Call of Duty series.

When used in conjunction certain wallhacks allow the player to shoot through solid objects, which is known as "opk" (One Place Killing) in such games as Combat Arms, because the killer can generally stay in one spot. A subset known as WhiteWalls removes the color/texture from objects in the surrounding environment, providing distinct contrast to opposition character models, which remain colored/textured. (See ESP for an evolution of the WallHack.) A subset of wallhacking is also called "chamming" (see Skin Cheats).

ASUS released wireframe display drivers in 2001 that enabled players to use wallhacks, announcing the settings as "special weapons" that users could employ in multiplayer games. In a poll by the Online Gamers Association, 90% of its members were against the release of the drivers.^[6]

ESP

Extrasensory perception, often read incorrectly as "Extrasensory precision" (ESP) in video games displays contextual information such as the health, name, equipment, position and/or orientation of other participants as navigation/directional markers, which would normally be hidden from game players. This may be performed by reading the program's memory with an external program, or intercepting and decoding packets as they travel between the client and the server, or else by reading the memory arrays containing player positions. The advantage of such a cheat is that it would allow the user extensive information about their opponents, allowing for selection or avoidance of less or more dangerous opponents, respectively. This is extremely difficult to detect and prove, but is definitely considered cheating.

Removal of game elements

Removals allow the cheater to remove a game's inhibitors or annoyances. These include gun recoil, bullet spread, and visual effects. Such removals can significantly increase a user's firing accuracy, but may be noticeable to other players. Removals may also consist of removing flash bang effects, which normally make the user's screen appear a bright white and mute their sound. With that particular removal, the user can continue play without loss of audiovisual input. Smoke, sky, hands, ground, doors, and many other elements are also removed in order to cheat. A more recent removal removes the ability to be kicked by a game, whether it be by a moderator or by vote-kick. This is often used in conjunction with other cheats and hacks to gain a permanent edge over the competition in a game.

Unsporting play

Boosting

A form of improving one's ranking in league tables, boosting is most common in 1 vs 1 fighting games such as Street Fighter IV and Tekken. Players will set up multiple accounts and play one against the other. The primary account will get an easy win due to no or little input from the second account. The major problem with this method is high cost because the boosting player requires at least two instances of the program usually through different PCs, IP addresses, and copies of the game. Additionally, some games allow matches to be uploaded and viewed by others on replay channel. If the boosting player accidentally allows this, their boosting match can be seen by others. This also works in MMORPG games, where you can set up multiple accounts and then conquer them. An example of this is Battledawn, where you can set up another account and conquer it to increase your score, power and taxation.

Even without matches being seen, players who boost can usually be easily identified, since they will have an extremely high number of points in relation to the number of matches played. For example, the 'top-ranked' player in Super Street Fighter IV has ≈35,000 pp (player points); in comparison, Daigo Umehara, widely regarded as the best player in the world,^[7] currently has ≈6,500 pp.

Disconnecting

In games where wins and losses are recorded on a player's account, a player may disconnect when he or she is about to lose, in order to prevent that loss from being recorded. This is usually done by known in-game glitches and 3rd-party sources via "IP booting" (a firewall software feature). Some players do this if someone is being unfair. In Street Fighter, someone might do a move that will kill if repeatedly used in timing, or set the timer low and hit a player so they can dodge around, and a player might disconnect to avoid a loss which they perceive to be unfair. A similar phenomenon occurs when a server operator boots an opponent or players who they do not support. More recently, the game Super Smash Bros. for Nintendo 3DS and Wii U and Counter Strike: Global Offensive have implemented a timer that appears after a player quits an online match; this timer restricts your ability to play online again to cut down on people intentionally quitting or disconnecting during the game. Disconnecting is considered unsporting, as the opponent may not have his or her "win" recorded.

Some games implement a disconnection penalty, usually by recording the disconnect as a loss, or a loss of experience points. Other games, such as UFC 2009 Undisputed, include a "disconnect" statistic in players' profiles, so players may select a match where the opponent will not be prone to disconnect. Team-based games such as League of Legends are highly dependent on each member participating, and one member disconnecting can greatly alter the outcome of the match so temporary bans are employed to discourage such behavior. The later games in the Call Of Duty give extra experience points for staying in a match, and records games in which the player leaves as a loss. Halo: Reach gives a random "lottery" experience-point bonus to players at the end of each match, encouraging them to stay until the end. Certain games also have a 'cool down' period before the player can disconnect, usually 10–30 seconds. This prevents a player from disconnecting if they are about to die or lose.

Rapid Fire Modifications

In many games the weapons featured can be fired in burst fire or single shot fire modes. Modifying a controller or console to gain the advantage of having a faster firing weapon than the standard player can be considered a method of cheating.

These modifications can create an imbalance within the game. In the Call of Duty series, having a semi-automatic pistol or rifle with a rapid fire modification could display the player as having the firing abilities of a heavy machine gun. In addition to modifying a console or its controller, it is possible to achieve a similar effect on the PC by binding the firing button to the scroll wheel of a mouse or using a macro setting that will simulate a key press automatically. For example, in the PC game Team Fortress 2, a pistol fired as fast as the player pulled the trigger. Because of this, many players used the scroll wheel or a macro to egregiously abuse this limitation, allowing them to fire pistols and other weapons far faster than was originally intended. Though this particular example was patched in an update, the exploit has not yet been prevented in many instances of first-person shooters. However, some games limit the rate at which semi-automatic weapons can be fired at regardless of how fast a player presses the button, in order to limit this form of cheating.

Environmental exploits

Exploiting is the application of an unintended use or bug that gives the player an advantage. Not all gamers view exploits as cheating, some view it as another skill because certain exploits take a significant amount of time to find, or dexterity and timing to use. An example of dexterity exploits include bunny hopping and texture-climbing in Quake. In the video game Ace of Spades, and the infamous wall bugs in GTA IV the map boundary is often easily accessible to every player, so it is not always considered cheating. Exploits are often considered cheating when they have an unbalancing effect, or are used in an intended manner.

Skin cheats

Chameleon skins, cham-hacks or chams, replace player model textures with brightly colored skins, often bright red/yellow or blue/green, that change color depending on whether the model is visible. For instance, an exposed part of an opponent would be shown in a different color, giving a cham-hack user an advantage over non-hack users, especially in games in which camouflage techniques (provided by in-game mechanics, objects or player models) are negated.

While cham-hacks are accomplished using a wallhack subset, historically, user settings (in Quakeworld, for example) or exploits in many older games allowed replacing skins arbitrarily with varying degrees of success—from pseudo-camouflage in dark areas of a map (prior to specular and other advanced lighting techniques) when using a "shadow skin"; to completely disappearing while the skin change propagated to other players; to forcing a plain-white skin on all opponents.

A more obvious skin cheat involves a person wearing a skin that makes him invisible to all players. However, this is a cheat that is easily discovered, especially if the game provides a killcam after each death.

Farming and stat-padding

In games where achievements and player abilities are unlocked by defeating a number of enemies or challenges of a particular class, players may arrange to win or lose against one another in order to obtain the achievements without having to play the game linearly. This is also known as stat-padding, swapping, or boosting, and most players do not consider it to be cheating unless it is used to win the game (or make it easier to win).

The term farming also refers to the practice of garnering achievements or virtual property for the purpose of real-money-trading.^[8] With rare exception, this has no direct effect on the gaming experience of other players; instead, it is a violation of most EULAs and could devalue the virtual property being farmed.

A special type of farming that occurs in multiplayer games where multiple players join a game that is based around objectives that end the game when accomplished, like capture the flag or domination, but instead of working to take the objective, they focus mainly on performing other actions for which the player is rewarded, such as scoring kills. These actions may result in greater rewards for the player than if the player were to attempt to complete the objective and end the game, though may impair enjoyment for other players. This is known as farming and is generally frowned upon. This was especially common in Call of Duty: Modern Warfare 2, where players would become angry and bitter when others would try and advance the game (e.g. planting a bomb at a target location that, if allowed to detonate, would end the game) and would discourage their team from protecting the bomb so the enemy could defuse it. This is because these players would attempt to farm kills to gain the tactical nuke ability, which would also end the game. Although this isn't considered boosting, critics of the tactical nuke cited this as a reason to exclude it from further Call of Duty games because it ruined the gameplay of objective-based games.

Character sharing

Sharing is when multiple people play using a single character—mainly in MMORPGs—to gain an advantage by having higher online times and/or being able to apply more manpower toward game activities such as leveling or gaining experience. In some MMOs this is not seen as cheating although others such as Nexon's Maplestory, Blizzard Entertainment's World of Warcraft, and Jagex's RuneScape specifically forbid it.

Twinking

Twinking is the act of giving gear intended for higher level characters to lower level characters that would be incapable of obtaining the gear on their own. Twinked characters have a huge advantage over untwinked characters, as well as the rest of the game world. This is usually used by players who wish to create a new character, to help them level more rapidly or gain an unfair advantage in PVP. Most MMORPGs tolerate it, provided that the twinked character is not used in player versus player combat with other characters of the same level, where it would have an unfair advantage over non-twinked characters. Often limits on twinking are placed into the game, usually through strict level or stat requirements to equip the item. Circumventing these level requirements would then be further cheating.^[9]

Ghosting

Most games allow other participants to observe the game as it is played from a variety of perspectives; depending on the game, perspectives allow an observer a map overview or attach a "camera" to the movement of a specific player. In doing so, the observer can communicate with an accomplice using a secondary communication methodology (in-game private message, third party communication, or even off-line) to inform friendly players of traps or the position of opponents. An observer can be an active player, using a separate computer, connection and account.

Some systems prevent inactive players from observing the game if they are on the same IP address as an active player, on the grounds that they are probably in close physical proximity; when all players from a single IP address are no longer active participants, they are all allowed to observe. However, this restriction can be easily evaded if there are multiple IP addresses available at one location (a common feature of broadband subscriptions), or if the observer installs remote desktop software on their computer, thus enabling their computer screen to be viewed by select other players in real time.

Secret alliances

Similar to ghosting in some respects, if two or more players to engage secret, co-operative play while all are active (especially in MMORPGs) it is considered cheating in many games, in particular when players engage in secondary communication. Using remote desktop software to observe the screens of secret "allies" while one is playing could confer considerable tactical and/or strategic advantages for all players in the "alliance", and would be considered cheating. In some RTS games, this is made difficult by replacing all player names with "unknown". This makes players unable to know who they are private messaging. Starcraft 2 and Warcraft 3 are examples of this anti-secret alliance setting. In games like Super Smash Bros. Brawl, sometimes when not using team battle, 2 or more characters would try to attack one character and have one character win. Most of the time these people would be the same character with the same or different costume.

Stacking

Stacking involves altering game settings or team lineups to give one or more teams an unfair advantage over others. One example includes arranging a team composed of skilled or known players (for example, professional players) against a team with members of lesser skill. Although this may be a valid and accepted practice in real-life sports, in online games stacking upsets less-skilled players who feel that they aren't being given a fair chance. Less ethical rigging involves weighting the game by providing a player or team with an advantage by outfitting them with better (or more familiar) weapons or equipment, or creating a play field that caters to a certain player, team or playing style. This also may involve creating team-size inequalities, for example a 5 vs 10 match. Many games prevent this by preventing players from joining a team with more players than the opposing side, forcing newcomers to balance the teams.

Scripting

Scripting is the use of a program or game feature to automate certain actions or behaviors. The use of scripts may or may not be considered cheating, depending on the behavior involved, and whether said behavior is replicable without the use of such script. A script may give the user unusually fast firing rate, unobtainable otherwise, or may perform seemingly trivial tasks such as reloading. Scripts can also tamper with other players' command systems, such as in Crysis games, where a certain script edit known as a "Longpoke" can force all players on a certain server to use the suicide command.

Implementation of cheats

In the client–server model, the server is responsible for information security and enforcing game rules. (See "Anti-cheating methods and limitations" below for drawbacks.) In the peer-to-peer gaming model, clients run equal code but are still subject to most of the same type of cheats found in the client–server multiplayer model; however, the peer-to-peer multiplayer model has deprecated in favor of the client–server model with the wider adoption of high-speed networks.^[10]

"Never trust the client" is a maxim among game developers (as well as other 'types' of developers) that summarizes the model of client–server game design. It means that no information sent from a client should be accepted by a server if it breaks the game rules or the basic mechanics of the game, and that no information should be sent to a client unless it is "need-to-know." For example, a server with no rule enforcement or data integrity checking will synchronize all of the clients with all of the information about all of the other clients. The server will be very fast, but any wallhack program will reveal where all the players in the game are, what team they are on, and what state they're in — health, weapon, ammo etc. At the same time, altered and erroneous data from a client will allow a player to break the game rules, manipulate the server, and even manipulate other clients.

Game code modification

Many cheats are implemented by modifying game software, despite EULAs which forbid modification. While game software distributed in binary-only versions makes it harder to modify code, reverse engineering is possible. Also game data files can be edited separately from the main program and thereby circumvent protections implemented in software.

Wallhacks and maphacks often function by modifying the software. Other cheats analyze or change the game state in memory, such as some aimbots and programs that give infinite ammo or health (often called trainers). Additionally, software with legitimate use outside of gaming can fulfill the role of a cheat when used inside a game. Examples include program accelerators and an auto clicker.

System software modification

Rather than modifying the game code (which the game itself or a 3rd-party protection system may detect), some cheats modify underlying system components. An example of this is graphics driver modifications that ignore depth checking and draw all objects on the screen—a primitive wallhack. System or driver modification is harder to detect, as there are a large number of system drivers that differ from user to user.

Packet interception, tampering & manipulation

The security of game software can be circumvented by intercepting and/or manipulating data in real-time while in transit from the client to the server or vice versa. Interception can be passive (see Ghosting and ESP) or result in active manipulation (see wallhacks); either methodology can be performed on the client machine itself or via an external communication proxy; some aimbots incorporate this methodology.

Anti-cheating methods and limitations

There are many facets of cheating in online games which make the creation of a system to stop cheating very difficult; however, game developers and third party software developers have created or are developing ^[11][12] technologies that attempt to prevent cheating. Such countermeasures are commonly used in popular games such as Team Fortress 2, Quake, or World of Warcraft, with notable anti-cheat software including GameGuard, PunkBuster, and Valve Anti-Cheat.

Exploits of bugs are usually resolved/removed via a patch to the game; however, not all companies force the patches/updates on users, leaving the actual resolution to individual users.

Authoritative and mirrored server design

Generally, the better the server is at enforcing the rules, the less of a problem cheating will be in the game.^[13] In this approach all client functionality either runs purely on the game server or alternatively the game server mirrors the client gameplay and continuously validates the game state. In for example many mobile games it is a common practice to run the client game sessions synchronously on the server, using the exact same user input. The client session is reset when the game sessions become unsynced, thereby preventing cheating. Some good examples of PC games that accomplished this are "World of Tanks", "War Thunder", and "Ark".^[14] This does not, however, prevent the user from modifying their client with the aim to alter the visibility or assist with their targetting, otherwise known as "wallhack" and "aimbot"

Server-side game code makes a trade-off between calculating and sending results for display on a just-in-time basis or trusting the client to calculate and display the results in appropriate sequence as a player progresses. It can do this by sending the parts of the world state needed for immediate display, which can result in client lag under bandwidth constraints, or sending the player the entire world state, which results in faster display for the player under the same bandwidth constraints, but exposes that data to interception or manipulation—a trade-off between security and efficiency.

When game servers were restricted by limited available resources such as storage, memory, internal bandwidth, and computational capacity due to the technologies available and the cost of the hardware, coupled with internet connections that were slow, it was believed to be necessary to compromise on security for optimization to minimize the impact on the end-user. Today however, with the increased speed and power of multi-core computers, lower priced hardware, and the increased availability of broadband internet, this has become less of an issue.

Non-standard datafile storage

Some games work to prevent hacking by storing game data in a custom-built private database format that strips file names and directory structures, but does not otherwise encrypt the file data. This is commonly visible as two files, one containing file data for all objects, textures, sounds, maps, etc. that is typically several gigabytes in size. A second file only a few megabytes in size contains the file and directory structure for the game to access data within the larger file.

Hackers sometimes examine these data structures to write unpackers that convert the database into a normal editable file and directory structure. The game engine may or may not use this extracted structure if it is present in the game installation directory.

Also because the actual game data in this huge file is typically not encoded or compressed, it is possible to look for common data file headers such as for JPEG, MPEG, or WAV and extract these individual files using a ripper, though this is done without knowing the database format or being able to write changes back to the game data structures.

Sometimes the container file is encrypted with asymmetric cryptography. The public key, which is used to decrypt the data, can be extracted from the game binary; the private key, which is required for encryption is only known by the developers, however. This allows reading, but not modifying the data. If only the checksums of the files are encrypted, this is called digitally signed content.

Client datafile checksums

One common method used to prevent cheating is for a checksum (such as an MD5 sum) to be calculated against each game datafile on the client computer, and for these checksums to be reported to the server before the client can join the game. When a cheater has modified a datafile to give them an advantage over others, the changes will affect the calculated checksum and may result in the client being automatically denied from joining the server if an unknown checksum is detected.

Someone who is attempting to cheat and who has downloaded a cheating package from the Internet may possibly be automatically banned by game servers, if certain well-known hacked datafile checksums are detected by the server during the connection attempt.

Once a datafile has been checked, it is held in a "file open" state, so that other software on the multitasking system can not rename or copy over a file after the check has been done, and the current game session is in progress. When the game session ends, the files are closed until the next check-in. This works only on systems that enforce such file locks, however. The kernel or libraries of a system could be modified to disable the file locking, without making this apparent to the program. Another problem with this approach is that the client can substitute the calculated checksum with the checksum for the original data.

Software obfuscation

Additionally to storing data in non-standard formats, some games also utilize runtime protection through software protectors. The key target is to keep attackers from directly inspecting or modifying compiled software. Protectors utilize either of three methods to protect software.

Encryption solutions will encrypt the code instructions and typically use a multi–layered defense mechanism against any reversing or tampering attempts that target the decryption code directly. Most protection systems in this category encrypt the code and then decrypt it at the application’s startup or during runtime. This is the moment at which an attacker will breakpoint, reverse, and inject custom code. Runtime decryption may also add significant processing overhead and lower the game's framerate. Alternatively, some solutions focus on obfuscating the code by inserting jump statements and seemingly random instruction paths. The final and strongest alternative is virtualization.^[15] In this approach the encrypted code runs on a virtual CPU that can be markedly different from generic x86 and x64 CPUs as the command set can be unique for each protected file.

The shared weakness of protectors and virtualizers is that they impact performance, either by requiring decryption or by introducing unnecessary CPU instructions. To reduce the overhead code virtualizers are often only used to secure the critical parts of the code base, such as those interfacing with the gamestate and rendering.

Player supervision

Spectator functionality can allow server administrators to monitor individual players and thereby determine whether or not a cheat is in place. One risk of the spectator mode is that in competitive matches the spectator could abuse the mode for spying on specific players and communicating player positions and tactics to the opposing team. Some games get around this limitation by not allowing spectator mode at all, or by delaying the video feed.^[16]

Some games have systemized player supervision by allowing the community to review reports of disruptive behavior, determine whether those reports are valid, and apply temporary bans if appropriate. Reports can include data such as screenshots, videos, and chatlogs. If the investigators collectively agree that an offense has occurred, a ban can be issued. The ban duration generally depends on the severity of the offense and the suspect’s history of convictions, if any.^[17]

Statistical detection

Anomalies in player behavior can be detected by statistically analyzing game events sent by the client to the server. The great benefit is that this anti–cheat method is that a pure implementation is non–intrusive to the player's privacy and guaranteed to work on all end–user system configurations. The restriction of this method is that it cannot always be clear whether or not a player is cheating. Highly skilled players can for example develop such a map sense that they may end up being flagged for the use of a wallhack and/or aimbot. On the other hand, players may also cheat in a way that they dwell under the detection thresholds and remain uncaught.

To reduce the amount of false positives, statistical detection systems are often combined with a supervision system that either is community driven or managed by a professional administrator team. In such implementations unusual player behavior can trigger a clientside component to create and upload reports for review.^[18][19]

Pattern detection

Pattern detection systems scan the player's hard drives and system memory for known cheat code or programs. Compared to statistical detection the key advantage is that also the subtle cheaters are detected. Other than this, a pure pattern detection approach generally has few advantages. Experience has shown that keeping detection based systems up to date is relatively slow and labor intensive as one needs to constantly track down cheats and update detection patterns. End–users may also be concerned with privacy issues, such as has been the case with VAC accessing browsing history.^[20]

Sandboxing

Sandboxing a software process can protect against potentially malicious actions such as code injection and memory modifications that would otherwise tamper with the game.^[21] One of the key benefits of sandboxing is that it can effectively prevent the underlying cheat mechanisms from working, and thereby can avoid the need for banning game community members as cheats simply don't work. Additionally, strong prevention mechanisms can stop many game hackers from targeting the game because of elevated skill requirements. Compared to pattern detection systems, sandboxing is generally not privacy invasive as the approach requires no data to be uploaded to foreign back-end systems.

Ramifications

Game publishers can implement a wide array of consequences for cheating players.

Player ban

Some companies and leagues ban^[22] suspected cheaters by blacklisting specific installation or serial keys, or user accounts, meaning that the player is effectively prevented from playing the game online.

In the case of a banned serial key, the banned player is able to mitigate the ban by purchasing an additional copy of the game which will include a new unbanned serial key. Some game publishers may decide to try and permanently ban players who are persistent in cheating and ruining the game community. Such bans are typically placed based on hardware ID or IP address. Consequently cheaters may develop ways of getting around these bans, by either playing through proxy or VPN servers, or spoofing or changing their hardware configuration. ^[23]

While game publishers are known to ban players employing cheats, the actual number of players banned is usually not revealed. Exceptions to this include Blizzard Entertainment, Nexon, and CipSoft, known for banning cheaters in batches, and publicising the number of banned accounts, presumably in order to discourage others from cheating. ^[24] Alternatively, game security service providers like EasyAntiCheat may limit themselves to publishing only fragments of their ban list in order to warn the community that action is being taken. ^[25]

Suspension

In some cases a ban may not be permanent and expire after a certain period of time. This approach is commonly used as a ramification for the abuse of game glitches, harassing players, or benefiting from hackers. Temporary bans may also be utilized in case a violation cannot be fully proven, as is common with anti-cheating methods based on supervision or statistical detection.

In-game kick

In general kicking is perceived as a mild ramification, serving as a warning rather than a punishment for the player in question. Some anti-cheat systems may decide to kick players out of a game server when the system integrity cannot be enforced nor be determined with certainty. ^[26] Other anti-cheat methods may also utilize kicks as an instant punishment for presumably unfair game play behavior. ^[27]

Some games may also provide the community with the option of voting for particular players to be kicked. Such system provides the power to self regulate and effectively get rid of abusive players without depending on supervision or other anti-cheat methods. ^[28] Even though vote kicking brings many benefits, it may also serve as a tool for trolling or griefing by allowing for legit players to be removed out of the game through the voting process. ^[29]

Demotion

When a violation is the result of farming or stat-padding, it may be too severe of a punishment to suspend or ban players. Some games therefore implement a system of demotion in which the offender is moved to a lower rank, the polar opposite of a promotion.

See also

• Valve Anti-Cheat
• PunkBuster
• Warden (software)
• Gaming etiquette

References

Further reading

• Exploiting Online Games, Hoglund, Greg, 2008, Pearson Education, ISBN 978-0-13-227191-2
• Cheating: Gaining Advantage in Videogames, Consalvo, Mia, 2007, MIT Press, ISBN 978-0-262-03365-7

External links

• Aspects of Networking in Multiplayer Computer Games by J.Smed et al., The Electronic Library, volume 20, number 2, pages 87–97, 2002.
• Fair Online Gaming Information on Intel's anti-cheat research initiative and technology.
• Cheat online Computer Games