Guild Wars 2

or similar.

For whatever reason, I feel the need to state that this is not a troll thread and I feel that part of our role as the GW2 community is to at least broach subjects that generate discussion. While the subject matter may not necessarily come too fruition, we can at least stimulate some useful discussions.

With that in mind and having been (somewhat) educated on client side hacking:
https://forum-en.gw2archive.eu/forum/pvp/wuvwuv/Flyhacking/first#post388131

Do we require some client side application to manage flyhacks/speedhacks etc. which all occurs client side not server side.

It seems relevant to discuss this too as the rate of hacking seems (imo) to be increasing and at this time we are unsure exactly ArenaNet’s role in managing it.

Anything but not Punkbuster.

They have no clue what they are doing and ruin more then they help.

I think the point is ANET needs to implement some sort of client side protection or at least an application that scans and reports to ANET for them to review. Especially since there are only 3 major hacking mods that people use and a good start would be to have this scan for signs of these 3 mods and ban any account that is found to be used with them. Again this will take a client side app, they cannot scan for these mods from the server since that would require unrestricted access to the client PC.

I’m a software developer by trade, so please just trust me whe I tell you there is no client-side solution that will do what you want. Sure, I could write a program that will scan for known hacks, and then this will be cross-checked against the server for evidence of exploits. Thats easy. Then the exploiters will hide from the scanning techniques used. It isn’t that difficult—if malware can do it, a program legitimately authorized to run on your system can do it far more easily.

Triggering an arms race does not solve the problem.

A quick-and-dirty scan doesn’t either. There might be three well-known hack programs, but how many obscure ones are there? At an old job of mine, my boss tasked an intern with writing a teleport/fly hack for a MMO that he (and most of the development team) played. It took the intern, working alone and in his spare time, one week to complete. It is not difficult to make a new hack program that would fly under the radar.

Main problem is that the server seems to have zero checks on what a client requests. So ArenaNet needs to fix their server code so a client just cant request anything it likes. As seen with specially teleport hacks.

The simple fact that clients can manipulate speed, z axis, teleport, noclip and even apply certain skills permanently is utterly absurd. The only hack that I can see ArenaNet be excused for is the FoV one. But the rest is simply extremely poor and sloppy work.

And when you look on some of the forums of such hacks. Then we got 2 kinds of people hacking.

One is the obvious one going full bore basicly. The others are like this guy:
“Each speed increase, increases speed by how much? I want to make sure I’m not going over 33% speed increase.” Not to mention the jump to dodge hack.

So basicly perma swiftness that almost nobody would notice.

You can never stomp out hackers, it is a 24/7 war. You write detection code they write code to bypass that detection method.

ANet needs to implement server-side validation using client-side prediction techniques. It isn’t perfect and could cause rubber banding in laggy scenarios but it’s better than what we are dealing with now.

Namu.5712:

You can never stomp out hackers, it is a 24/7 war. You write detection code they write code to bypass that detection method.

The best approach is server-side monitoring, flagging, and reporting of behaviors that are likely cheating. Client-side scans will always be bypassed, but if you are flyhacking, speed-hacking, or glitching through terrain, you can’t hide that fact from a program that is watching and intelligent enough to understand what is and isn’t possible.

Fildydarie.1496:

I’m a software developer by trade, so please just trust me whe I tell you there is no client-side solution that will do what you want. Sure, I could write a program that will scan for known hacks, and then this will be cross-checked against the server for evidence of exploits. Thats easy. Then the exploiters will hide from the scanning techniques used. It isn’t that difficult—if malware can do it, a program legitimately authorized to run on your system can do it far more easily.

Triggering an arms race does not solve the problem.

A quick-and-dirty scan doesn’t either. There might be three well-known hack programs, but how many obscure ones are there? At an old job of mine, my boss tasked an intern with writing a teleport/fly hack for a MMO that he (and most of the development team) played. It took the intern, working alone and in his spare time, one week to complete. It is not difficult to make a new hack program that would fly under the radar.

So if you can’t stop 100% you shouldn’t try to stop any % of hackers? Really?

That’s not what he’s saying. Using a system that scans for known hacks on the client is like is like plugging holes in a leaky old boat – there’s always going to be more of them and you’ll always be behind.

The correct solution is to assume all information received from the client is unreliable and have it confirmed by the server doing calculations of its own.

Namu.5712:

You can never stomp out hackers, it is a 24/7 war. You write detection code they write code to bypass that detection method.

You write detection code, everyone is banned, then they get to buy a new copy of the game and start over, it’s a cash cow! I never understood why they don’t do it.

Or in scenarios where you have to provide limited trust to the clients do spot checking by the server on x number of clients at a time. Flag suspet clients, and ban outright cheating clients.

Its also difficult to tell the difference between a cheat and a client bug.

If anet wrote code to ban everyone that was at 10,000 feet, they would have ended up banning engineers using rocket boots in the water as a bug launched them way up in the air :P.

So yeah, it isnt easy.

rndmize.9274:

That’s not what he’s saying. Using a system that scans for known hacks on the client is like is like plugging holes in a leaky old boat – there’s always going to be more of them and you’ll always be behind.

The correct solution is to assume all information received from the client is unreliable and have it confirmed by the server doing calculations of its own.

Exactly. If a person is capable of looking at a player flying through the air, or teleporting through a wall, or moving at a high speed for unusually long periods of time, there is no reason in theory why a program cannot look at the same data, and judge whether or not this gameplay is within normal limits, or is likely to have been caused by tampering, before escalating it up to a human to make the final determination.

Also punkbuster is terrible, and if installed I will no longer play gw2.

I hate it with a passion. It’s unreliable, piece of kitten, that doesnt even do its job properly. Last game I played with it, it gave me all sorts of trouble. From the get go on a new game it was kicking me out of servers for a variety of reasons (nothing to do with cheating… some other bullkitten).

Draygo.9473:

Or in scenarios where you have to provide limited trust to the clients do spot checking by the server on x number of clients at a time. Flag suspet clients, and ban outright cheating clients.

Its also difficult to tell the difference between a cheat and a client bug.

If anet wrote code to ban everyone that was at 10,000 feet, they would have ended up banning engineers using rocket boots in the water as a bug launched them way up in the air :P.

So yeah, it isnt easy.

Right, it isn’t easy. And you make a good point regarding client bugs, which is why it’s important to have an actual person in the loop at some point. You can’t just automatically ban people for stuff like this, but it helps tremendously to have something sift through the massive amounts of data to make some kind of sense of it before a human has to look at it.

Draygo.9473:

Also punkbuster is terrible, and if installed I will no longer play gw2.

I hate it with a passion. It’s unreliable, piece of kitten, that doesnt even do its job properly. Last game I played with it, it gave me all sorts of trouble. From the get go on a new game it was kicking me out of servers for a variety of reasons (nothing to do with cheating… some other bullkitten).

Yeah I had a friend that could not install video drivers from her laptop manufacturer because PB didn’t recognize them. Terrible.

Splintrr.7391:

NO, DEAR GOD, NOT PUNKBUSTER

Punkbuster solves nothing, instead of sawing through a wood fence, the hacker would just jackhammer through a concrete floor (punkbuster), regardless they are still gonna bypass and hack.

Just look at fps games on the market, hacks run rampant in them and a good majority runs punkbuster.

If they want to stop hackers then the server needs to monitor things internally.

Take a speed hack for instance, the server should be able to determine a players speed and location based on their world position, currently there is no tracking at all otherwise if someone tried to speed hack it would just rubber band them back to where they should be.

Thats just smart coding and has nothing to do with hack detection. GW2 server code is cheap im thinking. It is not smart code and has no sort of internal tacking what so ever hence you have teleport hacks, fly hacks and speed hacks.

You lock down things like player position, attack speed, attack range, etc etc you severely limit what a hacker can achieve client side. Because then instead of hacking their client they now have to hack the Anet server which is very risky and easily detected.