Net MP & Detering Cheating Part 2

Continueing Anti-Cheat Talk

 * If you haven't followed from the start you can get there:


 * From HERE

Cowboy's POV Part I

 * Hello,


 * Kinda have to keep this short. I�ve got class in a few.


 * Thanks for the link Rman. I�ve seen SecurePlay before. I think it was back in 1998 or 1999 when I looked into how their �anti-cheat� system worked. It was before Sony got hold of them.


 * With SecurePlay, you need to build your game against their libs and thus making it apart of your game. If I remember correctly, they �protect� game transactions by atomizing and wrapping game elements. Then later it can be used to �rebuild� and �construct� the game after it has been played. Something like a replay of the game, if everyone�s replay matches then hey, you�ve got a clean game. Don�t quote me on it, it�s been a while. If your game has a replay feature, then SecurePlay is a good choice.


 * Search for their patents from the US patent office and you�ll get a little more insight on the steps they take to secure game communications.


 * However, in my view, SecurePlay is mostly marketing. The �we solved all cheating,� again in my view, is hardly true. Suppose you did use SecurePlay for Warzone and wrapped all its elements in SecurePlay�s lib. What did we do? Obfuscate. But our transactions are encrypted. So what.


 * Let me explain.


 * With the current 1.10 implementation of Warzone, if I want to make everyone�s game screen say that I win. All I want to do is change my oil money every now and then when I get low. That gives me an advantage.


 * Warzone peers will detect that I changed my oil from 5 to 5000 and we will all get the infamous cheat detected/oil changed message.


 * This is great, but what if I change my Heavy Cannon Mantis Track cost value from 384 power units to 3 power units. That would save me some money wouldn�t it? Yes! That gives me an advantage. More power and less time to build my tanks. Great.


 * Does Warzone check this? At the moment, no. But you�ll certainly see it when the cheater invades your base with 85 units in 5 minutes.


 * In my view, the most fundamental problem for Warzone, in particular, is Warzone�s game logic. 5 HCMT tanks built in under 30 seconds& that must be one upgraded factory.


 * Using SecurePlay only protects the data by trying to secure/wrap it in memory, then protects it using encryption over a network. SecurePlay will eliminate packet modification attacks at the network level. But once we get hold of those treasured memory values on the local machine it�s easy to eject or modify what we want.


 * Suppose we modify those values and we seep in our nice values. Let SecurePlay do what it wants to the data, encrypt it, whatever it wants.


 * The data travels to the peers, gets decrypted, and seeps into the game logic on the peers. If nobody checks it, the cheater can make my game screen say he won.


 * This is why I think that it really comes down to the game logic. And using SecurePlay will only solve a part of cheating; attacks at the network level by using encryption.

Cowboy's POV Part II

 * So, DGO does not have �libs� that must be built against in order to for a game to be DGO aware. Only some code modifications will be necessary to make it compatible with DGO. I will most likely write an open-source GPL directgames.c file for Warzone that will provide a gateway between DGO and Warzone, mostly for game management.


 * When playing online, users can have the choice to play lan, play internet ip, play gamespy, play telephone, play whatever they want. My hope is, there will be an option to �play directgames.� In no way will DGO monopolize Warzone�s online experience.


 * However, the feature to �play directgames� is when Warzone will need DGO. DGO will provide the player match up and pass Warzone the list of players and IPs. DGO will verify game files etc. etc. Then we get back into the loop, well who trusts DGO and what if DGO is hacked ya ya ya. Remember, I�m providing an enhanced level of security compared to the players who do not choose to play on DGO.


 * Lets remember, that DGO is not the solve all cheats solution. But will provide some enhanced level of security for the match. DGO will have its own Warzone2100.dll that is downloaded from DGO servers. Warzone2100.dll is used solely by DGO and is closed source. That Warzone2100.dll plug-in contains game specific cheats to detect while the game is running.


 * There are some general algorithms that DGO has to suspect something is wrong with a game when someone attempts to modify a processes memory value.


 * I�m willing to open up the Warzone2100.dll cheat detection to a closed community, namely RTS.net.


 * I�m a bit tired and I need to get to class and finish my pcb.

--cowboy

Speaking to Killekulla & Cowboy POVS

 * You guys have provided a lot of food for thought.... a dang good meal too... thanks... :)


 * Cowboy: Have you thought about getting the C++ 2005 Source Code to "SecurePlay" ? Which as I understand is their "3rd Generation" of their methodology.


 * I'm pretty sure they'd let you have it for free.... as DGO is non-profit & because of your being an official student in this field.


 * Also my understanding is that "SecurePlay" can be game-specific customizable.


 * Killekulla: I understand it that way as well. That is you don't necessarily need "SecurePlay" software platform to adopt some of the "Core Methodology"...


 * But you guys have a better / deeper expertise on all this.


 * I'm just a novice student at best - but I am trying hard to extend my grasp of these issues on the tech side.


 * Much in this discussion has been a great help to me in that quest.


 * NOTE: They are very clear about making NO claims to be 100% Cheat-Proof.


 * What they DO claim is that they are the BEST off-the-shelf, multi-platform, middle-ware solution in on the market.


 * The 3d Generation of "SecurePlay" was released in October of 2004.


 * Almost 5-months now out there.


 * I've been searching hard to find Primary Sources that DISPROVE that actual claim.


 * I have yet to find it.


 * I'll continue looking because I have no bias one way or another... & as a novice my MO is to question all assumptions exhaustively using Occam's Razor, Socratic query, Scientific protocol & ever other impartial critical MO in my sceptics / gadfly toolkit.


 * Rman

Some More Research

 * To follow-up my last statement.


 * There are close to 9000 Refrences to "Secure Play" on the net.


 * No way do I have time to go thru every single one.


 * But through sub-searches (looking for "Failure" instances or cases) I've alighted on some interesting stuff.


 * Excellent article on the present state of Net MP Cheating:


 * Looked at in-the-round


 * The PunkBuster approach to anti-cheat..


 * PB Countermeasure MO


 * By assuming gamester-cheaters are


 * Quote:....Rule Authorative.... cheating is prevented based on a good "Rule-Set" (game-specific)....	NOT attempting to block individual hacks....."


 * Complete text HERE


 * Rman.