Tracking Players

[ZJJ]

Thanks for the responses guys.

So, in summary, I am hearing this....

1) It would be nice to know how the GRAW AC system works so that server admins can work with it efficiently. However, it's highly unlikely that GRIN will be allowed to talk about that level of detail.

2) Some like the idea of global bans and want GRAW to have such a level of AC. Would be nice, but only if the AC was 100%, which even PB isn't.

3) Community level bans. This seems like the only area we have any control. What's being done to work on this?

[ruggbutt]

FlimFlam, I'm impressed with your rationale regarding PsB, cheaters, etc. I wish you'd have been one of the cooler heads present during the Wit fiasco.

You rawk dude, seriously.

[ROCO*AFZ*]

Thanks for the responses guys.

So, in summary, I am hearing this....

1) It would be nice to know how the GRAW AC system works so that server admins can work with it efficiently. However, it's highly unlikely that GRIN will be allowed to talk about that level of detail.

2) Some like the idea of global bans and want GRAW to have such a level of AC. Would be nice, but only if the AC was 100%, which even PB isn't.

3) Community level bans. This seems like the only area we have any control. What's being done to work on this?

For #3 here is what we do...

http://www.attackforcez.com/index.php?name...79120b4ee2f92a7

For someone to be on our ban list our members have to get a screenshot of him cheating, lang or team killing. We need proof. If our guys don't have proof we don't ban them. We look at other squads ban lists, but if there is no proof and it's someone we see around a lot i write it down on a watch list. Just a note of what to look for.

We did this in GR1 also but had to have the replay or a screenshot of the offense also.

The offender is aloud to reply on our forums and as long as they don't cause any trouble (try to hack the site, impersonate us) they aren't banned from the site. M9 for example started going to other servers with AFZ tags... so he got the site ban.

Edited September 29, 2006 by ROCOAFZ

[MattiasWiking]

1) It would be nice to know how the GRAW AC system works so that server admins can work with it efficiently. However, it's highly unlikely that GRIN will be allowed to talk about that level of detail.

2) Some like the idea of global bans and want GRAW to have such a level of AC. Would be nice, but only if the AC was 100%, which even PB isn't.

Well, I give you a "short" description of it.

The most common "cheat" is that the files have been change. Therefor there is a file check that checks if there is diffrent files on the client then from the server. So, if the server have some altered/extra files all clients that doesnt have them will be kicked from the server. Anyone can setup a server with altered gamefiles and all clients that doesnt have the files will be kicked for altered gamefiles.

Also when the next map i loaded not all players loads is in the same speed. Then if one player starts the game the server will start to ask the clients for a response on the question "what-files-do-you-have?". If the client have not loaded the map yet he will not be able to answer the question, and when enough time has passed he will be kicked for altered gamefiles. This have been fixed to the next patch, but still ppl that timesout during game might be false tagged as cheaters by the anticheat system, and regarding timeout and answering AC questions there is nothing to do. So if someone setup a server and unplugg the network cable when the question for altered gamefiles is sent all clients will be kicked from server. If the person then is qiuck and plugg the cable in again before the server is shutdown 32 players would have been tagged as cheaters in the global banlist and all was done by the software.

Evil people will always find a way to add you to a global banlist, if there is any. Ive seen it happend to PunkBuster several times.

So, what should we do with speedhackers? Kick them ofcouse. The speedhack finds out if the clients CPU is running faster then it should. Most of the speedhack cheats take the time that the CPU says has passed and then double it. That meens that the player will move twice as far as the other players each frame. This we detect and if it happends the player get kicked. But, there is a known bug in a well known dualcore CPU that sometimes the CPU starts to run faster then it should. Ive seen it in GRAW and Ive seen it in several other games. This is a unintentional speedhack that can occure almost anytime. Should we add them to the global banlist? No we cant do that.

There is a couple of more AC things but Im not going to go in to thoose since it would only be a big favor to all cheaters.

But my conclusion is that there is no good way to add a global banlist and therefor we are not going to do that at this moment.

[CkZWarlord]

Global bans are bad. They should never have a place in any games in my opinion. Bans should always be local. Bad adminship, bad programming they can all cause bans that shouldn't have happened.

[SRS_Undertaker]

The only way to go is the same way we did it in the ACC for [GR] (those were great days Rugg ), unless Grin can get something decent sorted out. As Roco pointed out this sometimes took its time, but people do have privite lives as well as familys. Back then life was easier with the tools we had and the replay function.

Gobal bans: isnt the best idea really, to many factors play a part. I play Graw quite alot and often get the feeling thats somethings not quite right with the odd player or two, but proving it in this game is another matter.

EDIT: Until the bug that throws players out for "altered files" is sorted there is no way forward anyway.

Id would be for a outright AC Website for GRAW, pretty much along the lines of how we delt with things back in [GR] days, but unfortunatly until decent tools are avalible it would be a difficult project.

To quote Filmflan

Now lets look at a community ban list. What is it? It's a list of banned players by a group of server admins that have agreed to share their ban list. BTW it's already happening on a small scale as I know some admins already are sharing bans.

Thats exactly how we did it, and it worked.

Edited September 29, 2006 by SRS_Undertaker

[FI_FlimFlam]

This is going off topic a bit but it's to address Wiking on the kicking and banning.

I think in the case of the current AC global bans would not be a good idea. But the Community Ban List is going to happen (is already). We need more information regarding the kicks to allow the admins to make the decisions to either ban locally and what to put on the CBL. Couple that with robust enough logging in the AC that will give admins a tool to use and consult for bans (local or CBL).

One of the things that needs to happen, is that the AC needs to become more descriptive for it's kicks. A blanket "altered game files" for time out kicks isn't really appropriate. Stating that the "Player was kicked for Filecheck Timout" would be better and give admins and other players knowledge that they player wasn't caught with a cheat but rather had the connection timeout.

CPU speeds and speed hack. Knowing that there is an possible glitch that can happen unintentionally, is enough to know that if someone is kicked with "CPU speed timing conflict" that it wouldn't qualify for a CBL. It would be up to an admin to ban locally or not (hopefully not).

I it is a clear example for people to NOT just jump to conclusions about a person being a cheater initially when a flag is raised. And it's necessary to check with other admins and about the possibility of a false positive.

It illustrates the need for at least some kind of more detailed information regarding the kicks to be issued by the AC. So admins can make a reasoned decision about bans - other than griefers in their servers.

Addittionally it shows the need to have player information logged at connection like IP, GS name, MPID/CD-Key generated Hash, time joined and time disconneced, etc. That information is necessary to use for Admins to reference problem players when they are not in the server by culling the logs. Or when a player notices an issue in the server and reports it to the teams website it can be crossed referenced for tracking operational problems as well.

One of the things missing for admins currently is a basic understanding of the AC that can help differentiate between false positives and definite detections. Which Wiking has been kind enough to give us a bit more. Knowledge, patience, and reason are the 3 key things to help keep innocent people off a CBL as much as possible.

Edited September 29, 2006 by FI_FlimFlam

[ruggbutt]

If ya'll are globally banning because of software A/C then you're irresponsible.

I agree Undertaker, we had it good back in the day because we had all the tools we needed to do our job. It's amazing how not just gameplay has taken a step backward in online gaming. Devs need to realize that for a game to stay alive that the m/p component is necessary. I think GRIN is realizing this too, albeit a bit late. Part of the m/p component is some sort of anti-cheat that works. While PB is the best software A/C out there, it doesn't work as well as replays. PB is always being patched after the fact. So you're always playing catch up. Replays were the same since GR started and once I created my tool we could rely on them and be proactive.

I know that replays would create large files with the new physics model in some of the games, but there should be the option to have them. As a server admin I'd welcome even large files if it meant we could see for ourselves what was going on.

[ToW-Angel]

If ya'll are globally banning because of software A/C then you're irresponsible.

I agree Undertaker, we had it good back in the day because we had all the tools we needed to do our job. It's amazing how not just gameplay has taken a step backward in online gaming. Devs need to realize that for a game to stay alive that the m/p component is necessary. I think GRIN is realizing this too, albeit a bit late. Part of the m/p component is some sort of anti-cheat that works. While PB is the best software A/C out there, it doesn't work as well as replays. PB is always being patched after the fact. So you're always playing catch up. Replays were the same since GR started and once I created my tool we could rely on them and be proactive.

I know that replays would create large files with the new physics model in some of the games, but there should be the option to have them. As a server admin I'd welcome even large files if it meant we could see for ourselves what was going on.

I'm willing to concede to a CBL (community ban list). However, and I hope that this is something that will be considered, the following is something that could be strongly considered:

1) One website that the community server admins and appointees can vote/judge on a player if they are or not cheating.

2) A way to have our servers updated automatically from a repository of the CBL (community ban list).

3) There should be a way to have 2 ban lists... CBL and LBL. LBL for troublemakers, and CBL for cheaters.

4) The A/C should check the CBL to keep the cheaters out, and the LBL checked by the game to keep them out.

5) An auxillary program that updates the current CBL only.

6) Some form of log files that also gives addtional information about players like FlimFlam suggested.

I still believe that we, as a community, should have more setting available that allow us to check beyond a basic anti-cheat system like I mentioned in the other thread Here.

Edited September 29, 2006 by ToW-Angel

[SRS_Undertaker]

What you suggest above Tow-Angel is exactly what we had before in [GR], but it wasnt automatic. Everything was done by hand.

[ToW-Angel]

The only reason for the automatic thing is that you can set it up on a schedule to automatically update instead of people having to go to a site and taking the time to manually update their servers.

[SRS_Undertaker]

I agree with you fully on that and im sure it could be sorted.

[ToW-Angel]

I also hope that we have the ability to have two ban lists...

A CBL (community ban list) and a LBL (local ban list).

[SRS_Undertaker]

Thats easy to sort out.

[ToW-Angel]

The sooner we all can get something sorted out like this, the sooner the community could benefit from it.

[RAbbi_74]

The only reason for the automatic thing is that you can set it up on a schedule to automatically update instead of people having to go to a site and taking the time to manually update their servers.

Honestly, I'd prefer that server admins have a look at the lists before they put them into effect. Simple reason? In the event (not sure how likely) that someone they KNOW and TRUST is on one of those lists, they have the choice right then and there to call bullhockey on it. These lists need to be open to server admins to edit at will, as in to keep from adding players to their local lists that they don't believe to deserve bans.

I suppose this all still comes back to the trustworthiness of an accusation of cheating. And since we KNOW the A/C in GRAW is quite flawed yet, this now becomes very subjective. Each server admin must be able to evaluate the evidence of cheating for himself/herself to decide if a certain player was, in his/her own subjective opinion, in fact a cheater. Until GRAW itself can reliably pinpoint cheats and hacks, these ban lists aren't doing anyone much good.

Nice to have in the meantime, but by no means would I recommend an admin institute a ban based on a list that has no objective basis.

I'll again refer everyone to the Attack Force Z forum for what I feel is a great example of how to handle bans, and at the same time applaud ROCO and his gang for working out their own system of proving a cheat/hack before hitting the big ban button.

But do I know/trust every server admin out there who might possibly be allowed to contribute to a global ban list? Not a doggone chance, my friends. Ask yourself, "Who do I trust to decide whether or not I should be banned?"

Thought so...

[CkZWarlord]

To refer back to earlier post about reverse engineering hashing routines:

It *cannot* done programmitcally for as far as I am aware. If you could reverse engineer hashing routines then they wouldn't have gotten seperate name (hashing) from encryption. The reason for this is because they are so-called "fingerprint" routines that give an identifier for a certain file, string, object whatever. The reason you cannot reverse engineer is although they are highly unique they aren't truly unique. This means that collisions can occur.

A collision is the occurance of two completely different files generating the same hash.

Although I am not an expert on security with these routines (I do use them, but making them is a different story) they are unique enough to serve as a fingerprint of that file, but is all they are good for. And yes, having viewed a banlist, GR:AW does make use of a hashing routine. I think it's SHA-1 they use or MD5 (I think it's SHA-1 though).

But here is the short answer: Yes, hashing routines can be reversed but there is no guarantee that they will generate the same output as the original input.

[DeUcEsWiLd]

It would be a community who votes on who gets added to the ban list. Not a single individual, but the community that gets involved in who gets added to the ban list. I would trust the community over a single admin on who gets added to the community ban list. It is the community who will say who gets put on it.

[AMET_Balamir]

It would be a community who votes on who gets added to the ban list. Not a single individual, but the community that gets involved in who gets added to the ban list. I would trust the community over a single admin on who gets added to the community ban list. It is the community who will say who gets put on it.

I agree... But wich tools can we use to decide if someone is cheating or not?

Why CkZWarlord doesn't want to produce a script that can take screenshot from the player, at least during clanwars...

[RAbbi_74]

It would be a community who votes on who gets added to the ban list. Not a single individual, but the community that gets involved in who gets added to the ban list. I would trust the community over a single admin on who gets added to the community ban list. It is the community who will say who gets put on it.

Alright, but even THEN, who is this 'community' you speak of? I mean, there are something like 12,000 registered GRnet accounts I believe. So THAT can't be it. The team/clan who pays for the server? Fine, but if it's not passworded then a complete stranger is usually welcomed to jump right in and get to know everyone. How tempted would YOU be, knowing that a stupid lag issue or something could cause the sponsoring team to get you banned from playing in a LOT of GRAW servers? You're not their pal or anything, so why would they bother going out of the way for you? They don't know you from M9Whore...

Sorry, but I feel strongly that 'SHARED' banlists should be generated by a RELIABLE, CONSISTENT anticheat program. In the case of those banned by my favorite example, AFZ, there was overwhelming evidence of it presented and argued and hair-split in public forum before a ban was made, and even further discretion in sharing the lists of banned players.

Like me, everyone else playing GRAW (well, most everyone...) payed their $55 (or whatever in various other currencies) to play this game. SP only lasts so long, then MP generally (but not always) takes over their interest. Risk taking that away from players without a completely fair and impartial and consistent process for verifying without a doubt that they're cheating REGULARLY (a single indiscretion should not be grounds for perma-ban), and for what it's worth you'll lose my respect. Perhaps also my participation in a game that allows this to go on.

But let's go ahead with this idea at least until the first player cries foul over a community ban. With GRAW's A/C in its current state, that shouldn't take long at all...