The Spread Of Aimbots.

[Nux]

Yes, and I think that having to get a new email address to sign up to these forums for each time you got banned is one of the more tedious solutions:

- sign up to hotmail
- confirm hotmail address
- sign up to tremulous.net
- confirm signup to tremulous.net

The time difference between signing up to tremulous.net and for tremulous.net to send out the confirmation mail could be delayed programatically.

Two first steps are easily removed by using a disposable email service like mailinator (you'd have to track them all and ban them).
Artificially extending the duration of the registration process isn't that useful, because you can pipeline requests (submit  a dozen registration requests and wait for all of them to complete).

Apart from this I wanted to reiterate that any hardware based UIDs are useless on current PCs, because they can easily be forged and the software modified to send forged UIDs. What would be needed is hardware that has cryptographically signed serial numbers (by the hardware manufacturer). TPM which will be included in future PCs may support that (but is evil for other reasons).

Forging and Pipelining? Sounds to me like we're already on the right track since this is extra work for the hackster. We just need to keep asking ourselves if it would make their life harder if we want to know if it's worth it.

Now the trouble with these two examples are that I believe they could be done automatically once the necessary program is devised and created. After that it becomes a simple matter of downloading this program. Yet this 'simple matter' is still more work to do.

[Evlesoa]

Well when Null created the hack, and i tested it, it does NOT seem to work on a relic modded server. Wallhack worked, but the aimbot didnt. As null told me, its because the aimbot depends on values in-game that almost never change. I havent tested it on any other mods, but i can say that it doesnt work on relic. If there was a way to make the aimbot variables constantly change, the aimbot wouldnt work would it? How to do this im not sure, but you would need an aimbot coder to look for the values that the aimbot uses. One thing for sure is that there are memory based aimbots, and GL based aimbots. This however IMO would be pretty hard to find all of the values and make them constantly change...

[sleekslacker]

Well when Null created the hack, and i tested it, it does NOT seem to work on a relic modded server. Wallhack worked, but the aimbot didnt. As null told me, its because the aimbot depends on values in-game that almost never change. I havent tested it on any other mods, but i can say that it doesnt work on relic. If there was a way to make the aimbot variables constantly change, the aimbot wouldnt work would it? How to do this im not sure, but you would need an aimbot coder to look for the values that the aimbot uses. One thing for sure is that there are memory based aimbots, and GL based aimbots. This however IMO would be pretty hard to find all of the values and make them constantly change...

Please stop this mental diarrhea.

[Nux]

What has he said wrong? It looks like he's trying to share information about aimbot development.

It's posts like yours, that start needless flaming. =/

[Evlesoa]

its not mental diarrhea... and this was a long time ago... as I said, i stopped using it quite some time ago...

my point is, you need to have changing values allowing bots not being able to work... If u got variable X staying at X, but it changes to Y this game, next game changes to Z, then this would prevent bots... DUH just giving a suggestion

[Nux]

Thanks Evlesoa. For your intent to help and your restraint to sleekslacker's comment.

[Evlesoa]

Lol thx... im trying to help out the community here, and you guys r like "OMFG HAXX" and some people dont understand the difference between HAVING an aimbot, and actually USING it...

[Plague Bringer]

Well when Null created the hack, and i tested it, it does NOT seem to work on a relic modded server. Wallhack worked, but the aimbot didnt. As null told me, its because the aimbot depends on values in-game that almost never change. I havent tested it on any other mods, but i can say that it doesnt work on relic. If there was a way to make the aimbot variables constantly change, the aimbot wouldnt work would it? How to do this im not sure, but you would need an aimbot coder to look for the values that the aimbot uses. One thing for sure is that there are memory based aimbots, and GL based aimbots. This however IMO would be pretty hard to find all of the values and make them constantly change...

Please stop this mental diarrhea.

Help. If you're not gonna help, gtfo.

[benmachine]

If you have constantly changing values then how does the cgame know what to expect? They are different on relic servers because you are using different VMs to play. We can't cycle our VMs every other week to fight aimbots, and it's probably trivial to adjust anyway.

[sleekslacker]

What he said didn't make any sense.

If u got variable X staying at X, but it changes to Y this game, next game changes to Z, then this would prevent bots

 ?? wtf ?

Since Tremulous is an open source software, anyone can make a hack that fits any kind of mods. All it takes is effort and persistence. Null didn't test and adapt the hack for relic mod. Doesn't mean that making a slightly different mod will stop those hacks dead.

Actually my point is, you are talking rubbish.

[Evlesoa]

What he said didn't make any sense.

If u got variable X staying at X, but it changes to Y this game, next game changes to Z, then this would prevent bots

 ?? wtf ?

Since Tremulous is an open source software, anyone can make a hack that fits any kind of mods. All it takes is effort and persistence. Null didn't test and adapt the hack for relic mod.

My point is, you are talking rubbish.

No its not rubbish... because as Null said the aimbot he created only went with few values in tremulous that didnt change. In Relic mod, the value X (lets say the aimbot is attached to value X) has been changed to Y, then the aimbot wont function. In Normal tremulous it works because it re-attaches itself to X, as it finds it there again. Its like a mutation, if it changes then it cannot be vaccined until found. If it doesnt change, we know what type of a bacteria it is. Same as here, aimbot doesnt mutate, but Tremulous's values do... causing it to not function...

Not the best example, but it works

[sleekslacker]

As I said earlier, he can just look at relic's source code and adapt his hack according to the changes. What you are describing is like a bug in his aimbot. If he is not lazy he can fix it quickly.

[kevlarman]

No its not rubbish...

yes it is rubbish, just because he took an existing q3 aimbot and changed a few headers to make it work with trem 1.1 doesn't mean it isn't rediculously easy to change it to work with the current vms, or to make it completely independent of the vms.

[Evlesoa]

UGG!!! thats not what im saying...

Im saying: DYNAMIC GUID this means... GUID changes constantly correct?

What IF: Tremulous's values and variables were dynamic, and changed? Ex; Variable X that aimbot attaches to, changes constantly, causing it not to function... or a detection system of some sort... you cant adapt an aimbot to follow a value that constantly changes, it would be pretty hard...

[kevlarman]

UGG!!! thats not what im saying...

Im saying: DYNAMIC GUID this means... GUID changes constantly correct?

What IF: Tremulous's values and variables were dynamic, and changed? Ex; Variable X that aimbot attaches to, changes constantly, causing it not to function... or a detection system of some sort... you cant adapt an aimbot to follow a value that constantly changes, it would be pretty hard...

you can't adapt the client to follow that variable either, but it takes much less time to update an aimbot than to update trem and get all 500,000 players to download a new copy.

[sleekslacker]

If he has the source code, he can figure out the pattern in which the variables are changed ( I still don't see how changing variables can stop them hacks, all I know is you are changing the function / data structure interface between the VMs ). If you have the source code, you can go around any measures taken to stop these hacks. To win against them, you need to make sure their effort takes longer and longer time until it becomes not so worthy to do.

[mindfray]

Have you guys thought of getting punkbuster to work with this quake 3 based game? I doubt it would have to be modified that much to work with tremulous. after all they have it for wolfenstien et, quake 3, quake 4 ect.

[kevlarman]

Have you guys thought of getting punkbuster to work with this quake 3 based game? I doubt it would have to be modified that much to work with tremulous. after all they have it for wolfenstien et, quake 3, quake 4 ect.

evilbalance will never grant trem a license for punkbuster, and it doesn't even stop determined cheaters. the only thing it does is add a closed source component to tremulous.

[Warrior]

Sorry to copy/paste that content with excessive references to UT...

http://www.battleye.com/

BattlEye integration into Urban Terror!  [ 01.04.2007 • 03:00 ]

The BattlEye Anti-Cheat Engine will support the upcoming release of Urban Terror v4.0 (standalone) with its powerful capabilities.

Urban Terror will be the first game to use the BE Client on Linux as well. In addition, this marks the fundamental change of the BattlEye system: BattlEye will no longer require a central master server but use the separate BE Server module directly integrated into the game server.

The game will be released shortly. And that's no April's fool! Check www.urbanterror.net for more information.

http://urbanterror.net/news.php?item.130.1

When using Urban Terror without Quake 3 Arena (using ioUrbanTerror), it's not possible to use PunkBuster. Although it's possible to have a game without an anti-cheat system, we all know it's better to have a protection from at least the public cheats that are out there.

We are therefore glad to report that the developer of BattlEye agreed to make BattlEye support available for ioUrbanTerror. It's not yet sure if it will be available as soon as Urban Terror is released, but it can easily be added later with an ioUrbanTerror update if needed. If this anti-cheat system turns out to work well, there's no reason to keep using PunkBuster any longer, which means the community will no longer be split up between old school and new players.

Although this is very good news, there's also a drawback. BattlEye works on Linux and Windows only. It does not support Mac clients (yet). The developer did say there's a possibility of support for Mac clients in the future, if a good Mac coder can help accomplish it. As a temporary 'solution', Mac users can play at servers that don't use BattlEye, or use bootcamp to play though Windows. We are aware of the great community members out there that use Macs and we regret that it isn't available for them from the start, but we believe the importance of having an anti-cheat system outweighs this fact.

http://www.battleye.com/info.html

The Engine

The BattlEye system consists of the BE Master Server and the BE Client, using the game server like a proxy to communicate with each other. The BE Client runs within the game, allowing best possible detection of cheats.
BattlEye scans the game and the system in RAM and on HDD, mainly using generic methods that globally catch all cheats/hacks of one type (including private ones as far as possible).
In order to work, BattlEye requires absolutely no user input or server-side administration - it comes as is and does its job independently. This also applies on the effective auto-update system which works reliably flawlessly and thus ensures that each player is always up-to-date.
Furthermore BattlEye has no special system requirements. It runs on every machine, needs only little resources (CPU/bandwidth) and, for example, will never force you to play with administrator rights. The player simply will not notice that BattlEye is running in the background.

BattlEye + Tremulous?
Or is it a noob anti-cheat system?

[null]

also punkbuster is crap and easily beaten

Apart from this I wanted to reiterate that any hardware based UIDs are useless on current PCs, because they can easily be forged and the software modified to send forged UIDs. What would be needed is hardware that has cryptographically signed serial numbers (by the hardware manufacturer). TPM which will be included in future PCs may support that (but is evil for other reasons).

since trem is open source, all you have to do is take the final string right before sent and change it to make it fake

evel: that wont work either, if relic is open source it can easily be owned. also, even if not open source you can find addys to all the vars you need and hack it like that

with open source you cant really stop cheats, you can only delay them

also, the aimbot was not just a modified quake3 hook, was coded by hand especially for trem.

the best option (or at least a smart one) would be a closed source anticheat that is loaded by game client and can be enabled or disabled, because at least then you can just update anticheat without updating game.. or better yet you can have some sort of detection

also, i admit im surprised by how smart the trem commun seems to be, most are idiots like "OMFG CHEETSZ DEV PLZ STOP EM" instead of actually having ideas

[.f0rqu3]

first code a real aimbot
it is pretty lame to use ogc as it is with a game that where you hit matters

[Eeeew Spiders]

I think the one of the points that Evlesoa is trying to say is that the more you change the trem code from the standard q3 engine code, the more work it is to adapt an existing q3 aimbot for trem. And that point is valid. It doesn't mean it makes it impossible to write an aimbot code for trem. But its still a valid suggestion that doesn't deserve flaming.
Also the dynamic changing of trem values to which both the client and aimbot code needs to adapt to is an interesting one, also if this doesn't make it impossible to write an aimbotcode for trem.

But I am having another thought. Though there is a certain amount of players that seem to be using aimbots, maybe this is all not such a big problem. How often do i actually encounter a cheater or a griefer. Its not that often.
Aimbots are easy to detect. The demos provided by d0t, Nux  and others proof this. I'd be much more worried by hacks and cheats that are not that easy to spot. But then again, if they are not that easy to spot, how effective can they be? Maybe we don't need a better system. Servers like Wrath proof that you can have many fun rounds, even weeks without big disturbances.

[Superpie]

Let's ban all Earth IP addresses like we did with Poland, that will most definately stop the botses.

[Satan]

first code a real aimbot
it is pretty lame to use ogc as it is with a game that where you hit matters

if that is the null im thinking then he did code a bot and a really damn good one. but having idea's how to stop it or get around it is pretty kewl to see.

[R1CH]

BattlEye + Tremulous?
Or is it a noob anti-cheat system?

When I last looked at it, it was trivial to bypass for anyone who knows their stuff and isn't just a script kiddie. I don't know if any improvements have been made since then though and I don't know if the cheaters in Tremulous are determined hackers or just kiddies. The main issue with a Tremulous anticheat is compatibility - any client side anticheat has to work on Windows, Linux and Mac given how diverse Tremulous is.

[null]

long time no see r1ch, i remember you from diablo..


anyways, aimbots can get a lot harder to detect. mine is a very simple, more like a 'demo' cheat rather then a full fledged thing. i could make it a lot more complex if you want, but i doubt you want that :p

and f0rq, thx, ill take that as a compliment

I think the one of the points that Evlesoa is trying to say is that the more you change the trem code from the standard q3 engine code, the more work it is to adapt an existing q3 aimbot for trem.

maybe harder to copy and paste.. but not much harder to code for because you still are following a lot of quake3

Also the dynamic changing of trem values to which both the client and aimbot code needs to adapt to is an interesting one

its a "cool" idea, but wtf do you actually mean :p

[kevlarman]

http://www.battleye.com/

it's not worth forcing tremulous back into contrib just for something that won't stop determined cheaters.

[Nux]

Are you saying we shouldn't discourage the majority of lazy cheaters because we won't stop the few determined ones?

[Eeeew Spiders]

Also the dynamic changing of trem values to which both the client and aimbot code needs to adapt to is an interesting one

its a "cool" idea, but wtf do you actually mean :p

As null told me, its because the aimbot depends on values in-game that almost never change.

Since the idea doesn't work, I am not sure its worth it to elaborate on it. I just wanted to say that the idea sounds "cool" too and doesnt deserve flaming.

Are you saying we shouldn't discourage the majority of lazy cheaters because we won't stop the few determined ones?

Determined ones will always put up their methods for download to feed the lazy ones

[Seven]

How about instead of trying to prevent bots, unpure clients, h4x, etc. from connecting, the servers implement some form of honeypot/hack detection to identify and kick/ban/publicly humiliate offenders based on playing style and 'human' characteristics.

Two possible honeypots come to mind:

 1 - place a 'dummy' in the view of the players randomly, just for a few frames. It should be too quick for most players to notice, let alone take aim at. If it gets (accurately) shot at, then the server has good reason to suspect a bot may be in use, so do it a few more times in various different ways to try to confirm or deny that suspicion. The dummy must have all of the attributes of a real player (maybe those of another real player in that game) so that it cannot easily be distinguished by the bot.

 2 - (a bit less useful) as per above, but have the 'dummy' come running around a corner from the player, but dissapear just before actually becoming visible - if the player shoots in the direction of that corner within 100ms, suspect wallhack. (NB: this has a weakness - the hack/player may be smart enough to listen for movement sounds. Still good if dummy is a dretch or in situations where there is a noisy fight nearby)

In addition, the servers should look for players that do strange things like aiming 'too' perfectly, etc. Players that are well known to be insanely good will need exceptions in place so they don't get falsely identified.

Advantages over most other suggestions here so far:
   - Server side, so to update it does not require any update to client software
   - Server side, so it's not possible to hack around it and/or disable it
   - Not reliant on any sort of forgeable GUID, hardware id, etc.
   - Can be disabled for known good GUIDs, admin levels, etc per server
   
Dissadvantages / weaknesses:
   - Bandwidth and proccessing requirements on server
   - Intelligent bots may be able avoid certain honeypots
   - A constant race between devs and h4x to outsmart each other