Statement about cheating prevention is missing

Turelus · June 2016

Slightly disappointed with the answer, I kind of expected something more...

yodased · June 2016

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

Nifty2g · June 2016

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

This is very disappointing

Ch4mpTW · June 2016

Nifty2g wrote: »

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

This is very disappointing

This whole situation got me holding my forehead confused and irritated af right now. Lmao. It's like Zenimax is playing with my emotions. They lead you on like there's something of substance, and then when you look into what they lead you on to -- there's nothing! So you're back at Square 1, and more frustrated because you wasted your time.

NewBlacksmurf · June 2016

Nifty2g wrote: »

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

This is very disappointing

And because I'm by default skeptical....you often think

Hmm, well is this software developed by someone who has specific details or was it as results of trial and error?
Is it a leak or was it just great engineering?

Or

Is the development team just so out of touch with the game they develop because they don't play it, that unless the community points out things that we see all the time, nothing happens?

For me, the OP question was a broader question of "Hey ZOS, now being made aware of recent and past "cheats" are you going to take a stance?" If yes, what rules and guidelines will we be made aware of?

yodased · June 2016

I want to make sure that I am as clear as I possibly can here:

Cheat engine is just a GUI on top of some basic 'hacking' ideas. It's not like this guy made a program that hacks online games and is selling it, its free and its a tool to be used for developers really. It literally is meant and coded to be FOUND by the server lol.

Read this

https://en.wikipedia.org/wiki/Memory_address

to learn some about how programs store values for your machine and then read this:

http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

to learn some about what they do when they get the memory locations.

So once you understand that this program literally intercepts the data being sent from the program to your RAM and then from your RAM to the server, you can see how this is a hard thing to catch.

Sure, you can boost your stats by 400% and get unlimited ultimate, but that will ping the server because you are outside the specs of normalcy.

The issues arise when people don't do that, they test to see what parameters are able to be 'tweaked' without issue, so grab a cheap throwaway account and test test test until you get banned, then turn it down below that ban point on your main and you will be +% higher than anyone else, never being caught.

How to fix:

Server side checks with less trusting of the client. The server has to know the expected answer of the client and the client must show its maths to the server.

This will significantly slow everything down.

Nifty2g · June 2016

NewBlacksmurf wrote: »

Nifty2g wrote: »

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

This is very disappointing

And because I'm by default skeptical....you often think

Hmm, well is this software developed by someone who has specific details or was it as results of trial and error?
Is it a leak or was it just great engineering?

Or

Is the development team just so out of touch with the game they develop because they don't play it, that unless the community points out things that we see all the time, nothing happens?

For me, the OP question was a broader question of "Hey ZOS, now being made aware of recent and past "cheats" are you going to take a stance?" If yes, what rules and guidelines will we be made aware of?

No it's just disappointing how far the community will go to cheat even just a little bit if they have to rather than just playing the game for fun, I know this doesn't apply to a lot of people but those who were doing it are still capable of doing it, just with even less help they were getting
I was hoping the update to say we put a block on the program being used, even if there were others and put blocks on those too until there is a way to properly fix it from happening. 43 is a very low number if you consider the possbilities of someone using it to increase your stats or reduce your cost marginally compared to others. Cheating is still cheating, but what can you do at this point.

It's just highly disappointing for the amount of time I've personally put into ESO and how much effort I put in for competitive play for something like hacking to this extent exists. It's a real shame really.

Rohamad_Ali · June 2016

Look , fellas , they're not gonna go into detail anymore . They already said they're being vague on purpose . I seriously doubt you're gonna get an answer on perma bans being lifted or what they can or can't do to catch cheaters anymore after that statement . It's a waste of energy to keep shoving the microphone in their face for more clarity .

NewBlacksmurf · June 2016

yodased wrote: »

I want to make sure that I am as clear as I possibly can here:

Cheat engine is just a GUI on top of some basic 'hacking' ideas. It's not like this guy made a program that hacks online games and is selling it, its free and its a tool to be used for developers really. It literally is meant and coded to be FOUND by the server lol.

Read this

https://en.wikipedia.org/wiki/Memory_address

to learn some about how programs store values for your machine and then read this:

http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

to learn some about what they do when they get the memory locations.

So once you understand that this program literally intercepts the data being sent from the program to your RAM and then from your RAM to the server, you can see how this is a hard thing to catch.

Sure, you can boost your stats by 400% and get unlimited ultimate, but that will ping the server because you are outside the specs of normalcy.

The issues arise when people don't do that, they test to see what parameters are able to be 'tweaked' without issue, so grab a cheap throwaway account and test test test until you get banned, then turn it down below that ban point on your main and you will be +% higher than anyone else, never being caught.

How to fix:

Server side checks with less trusting of the client. The server has to know the expected answer of the client and the client must show its maths to the server.

This will significantly slow everything down.

@yodased
I hope everyone in the discussion understands what you posted...if not, its great info to read up on.

For me...not saying this applies to others, in what can be viewed as harsher comments from me in this thread and others, ZOS' has the information to address this. While we don't need those details, the concern is really just as basic as this.

"Because its evident that ZOS doesn't play their own game enough to be aware of this, will a new stance be made to change the opportunities of things like this?"

From what we see in their response, the actual answer is in two parts.
1. We are checking more on checks
2. No we haven't changed our stance

So someone like me interprets those responses (paraphrased in my context) as:
-While we are appreciative that our forum community sought to bring this to our attention, we aren't changing our stance therefore you will continue too see "cheaters" but we would like you all to continue reporting such behavior.

Its like the situation where someone reports a crime and the authorities response is....thanks for reporting it, we will make some arrests but largely all we are going to do is put some people in jail and do little to prevent future occurrences.

thats not a good state to be in.

Nifty2g · June 2016

Roehamad_Ali wrote: »

Look , fellas , they're not gonna go into detail anymore . They already said they're being vague on purpose . I seriously doubt you're gonna get an answer on perma bans being lifted or what they can or can't do to catch cheaters anymore after that statement . It's a waste of energy to keep shoving the microphone in their face for more clarity .

We do not want information on the perma bans. We want information on this program being used and what is being done about it's uses. Seems like people can still use it from no comments about it

Ch4mpTW · June 2016

NewBlacksmurf wrote: »

Nifty2g wrote: »

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

This is very disappointing

And because I'm by default skeptical....you often think

Hmm, well is this software developed by someone who has specific details or was it as results of trial and error?
Is it a leak or was it just great engineering?

Or

Is the development team just so out of touch with the game they develop because they don't play it, that unless the community points out things that we see all the time, nothing happens?

For me, the OP question was a broader question of "Hey ZOS, now being made aware of recent and past "cheats" are you going to take a stance?" If yes, what rules and guidelines will we be made aware of?

As a computer programmer, who gets paid to not only write code for companies but test their software with "offensive security tactics" -- I can tell you that this whole situation is baffling... And I've worked with some very high-end clients. And I do mean very high-end and prestigious clients.

When you have an application or program written, you're supposed to thoroughly analyze and examine it for any and all leaks. Any and all exploits. Both old and new. You're supposed to rip that software to pieces, and test it as much as possible. I mean really tear into it. You do this to not only simulate the type(s) of attack the software may be faced with, but how it'll handle it these attacks when faced with it. You do this to also see what type of reactions your software will produce once manipulated as such, to try and patch said any leaks or anything of the sort before the public touches it. Actually even before the "official" testing team touches it, you (the writer) are supposed to do this vigorous testing. So how something like this even happened, still has a me itching my head.

And what trips me out even further is when we report said bugs and exploits, and they remain in the game until enough complaints build up about them for months. And then they finally decide to do "something" about it, even though we never what that "something" is that they did as preventative measures. A lot of these complaints we've been having recently are relatively old. Seriously. They're old af. You can find threads on these forums with complaints about the same or similar things that were happening months ago.

Turelus · June 2016

yodased wrote: »

You guys realize they are not going to tell you that there are doing anything about cheating even if they had the silver bullet, right?

It's counter productive to disclose your defense plan to your attackers.

That being said, if you understand how this base level 'cheat' system works, you will realize there is nothing that they can do to identify every user of this software.

Intelligent people will still be able to get significant boosts over normal non cheating players and will never be caught until the server does more checks and relies less on the client trust connections.

That doesn't appear to be any time soon as that would require quite a lot of re-vamping major systems across multiple platforms.

The best we can hope for is they are now monitoring reports a lot closer are are less forgiving with the ban hammer, which we all know will not be true.

There will be people cheating in this game for the forseeable future.

Not really true, you can watch the CCP security presentations and they reveal a lot of information to reassure their customers without giving away any of their secrets.

Different companies different cultures though I guess.

ИВАН_ВОДКА · June 2016

yodased wrote: »

I want to make sure that I am as clear as I possibly can here:

Cheat engine is just a GUI on top of some basic 'hacking' ideas. It's not like this guy made a program that hacks online games and is selling it, its free and its a tool to be used for developers really. It literally is meant and coded to be FOUND by the server lol.

Read this

https://en.wikipedia.org/wiki/Memory_address

to learn some about how programs store values for your machine and then read this:

http://resources.infosecinstitute.com/using-createremotethread-for-dll-injection-on-windows/

to learn some about what they do when they get the memory locations.

So once you understand that this program literally intercepts the data being sent from the program to your RAM and then from your RAM to the server, you can see how this is a hard thing to catch.

Sure, you can boost your stats by 400% and get unlimited ultimate, but that will ping the server because you are outside the specs of normalcy.

The issues arise when people don't do that, they test to see what parameters are able to be 'tweaked' without issue, so grab a cheap throwaway account and test test test until you get banned, then turn it down below that ban point on your main and you will be +% higher than anyone else, never being caught.

How to fix:

Server side checks with less trusting of the client. The server has to know the expected answer of the client and the client must show its maths to the server.

This will significantly slow everything down.

thanks for this post
its pretty clear and understandable
cheers

Cuyler · June 2016

Nifty2g wrote: »

Roehamad_Ali wrote: »

Look , fellas , they're not gonna go into detail anymore . They already said they're being vague on purpose . I seriously doubt you're gonna get an answer on perma bans being lifted or what they can or can't do to catch cheaters anymore after that statement . It's a waste of energy to keep shoving the microphone in their face for more clarity .

We do not want information on the perma bans. We want information on this program being used and what is being done about it's uses. Seems like people can still use it from no comments about it

This is exactly what everyone I talk to and myself would like to know. Can they still use Cheat Engine or not. And when will ZOS eliminate the opportunity to do so. I could care less HOW they do it, as long as it's done. Confidence will remain low until such time.

Rohamad_Ali · June 2016

Nifty2g wrote: »

Roehamad_Ali wrote: »

Look , fellas , they're not gonna go into detail anymore . They already said they're being vague on purpose . I seriously doubt you're gonna get an answer on perma bans being lifted or what they can or can't do to catch cheaters anymore after that statement . It's a waste of energy to keep shoving the microphone in their face for more clarity .

We do not want information on the perma bans. We want information on this program being used and what is being done about it's uses. Seems like people can still use it from no comments about it

Everyone would like that info , especially the cheaters . Then they would have more info to go on to keep the cheats undetectable .

yodased · June 2016

@newblacksmurf

It's a broken record. I have been involved in this game since april 2014. There are other. smarter guys and gals that have been here longer also talking about it.

I have mentioned cheat engine, by name, at least 20 times in the last 2.5 years, both in direct conversation with green text as well as here in the forum.

The end result is the same:

the server does not check the client enough so there never can be a way to stop memory hacks.

I'm sure that ZOS hates the fact that there server architecture isn't set up in a way that they can monitor network activity on a granular level, but it is what it is.

Tell you what though, I played for a year on PS4 and I never once thought "How the *** did I just die"? I was on PC this week again since I missed my awesome guildies and I have had over 10 moments of 0.o thats ***, no way that is legit

take that for what its worth, but you don't have 3-4 dizzy swings, two executioners and a ferocious leap hitting you in < 3 seconds on console.

rhapsodious · June 2016

From what I know as my experience as both a developer and (albeit on a much smaller scale project) being privy to the backend of how PR works, their hands are pretty tied on giving us more specific information.

Consider:

"We have detected some users using a program known as X to alter the game client by doing Y. We have implemented Z on our end to mitigate this."

To someone who is determined to cheat, this seemingly innocuous statement has provided them with three very useful pieces of information, and more if they're good at extrapolating. Getting around this, then, to a determined cheater isn't incredibly difficult.

Meanwhile, if ZOS remains vague, while it is annoying for the regular user, it works best in their favor because it keeps the cheaters on their toes. They don't know if they're being watched, so to speak. Often in "subtle" cases, what will happen is they will observe that user more closely and put their behavior under a magnifying glass for erratic behavior. I have no idea if ZOS is actually doing this, but I sure hope they are!

Just my $.02. I do wish they could be more specific, but in this case, I understand why they aren't.

yodased · June 2016

@cuyler yes 100% cheat engine or any other memory scanner/modifier will still work with this game. It will continue to work with this game forever, until they change their server-side checks.

You don't need ZOS to tell you that, anyone who creates software can tell you that.

ИВАН_ВОДКА · June 2016

Cuyler wrote: »

This is exactly what everyone I talk to and myself would like to know. Can they still use Cheat Engine or not.

@Cuyler the only one answer on this question can be only one
at the moment

try yourself and figure out
(on PTS for example, to not be banned)

until any official statements about yes/no on your question

Arthg · June 2016

I'll just repost the fake announcement that I posted in another thread and that I, for one, would have loved to read:

************* ANNOUNCEMENT AVAILABLE IN THE LAUNCHER ***************

Dear ESO community,

We would like to apologize for our chronic failure, from the creation of this game onwards, to address the issue of hacks and cheats now plaguing Tamriel. This weekend's dramatic events, where a few renowned players of our US servers displayed the Zeus-like possibilities that certain trivial cheating platforms could give, have opened our eyes to the endemic scope of the problem.

In order to reestablish a healthy and rewarding gaming environment, here are the steps we are planning to take in the next few months:

* we are redirecting resources to rewrite the client / server architecture to reduce the number of client-side critical values;
* we will be considering using a 3rd-party software to further secure the integrity of client information, and reduce the load of calculations on the servers;
* game masters are being recruited as we write this message. They will be regularly visible on both EU and NA servers; members of the community willing to apply for the position should send an email to @ZOS_hiringGM.
* regarding past cheats, fine-grained algorithms are being written to filter out abnormal regeneration, movement speed and damage values. The number of reports and the rate of ultimate regeneration will no longer be the only parameters used to detect cheaters.
* all leaderboards are being scrutinized;
* Confirmed cheaters will no longer have their accounts "perma-banned". Instead, all their characters will be pilloried in a new dedicated area in Coldharbour, in perpetuity. These characters will never be able to move in Tamriel again. Players will be invited to feed them radish or give them the /dishonor emote.

Our dear community is invited to understand the changes will not happen overnight.
We do hope, however, that these measures will help keep, or regain, your trust.

Happy questing,
Happy fighting,

ZOS.

Rohamad_Ali · June 2016

yodased wrote: »

@cuyler yes 100% cheat engine or any other memory scanner/modifier will still work with this game. It will continue to work with this game forever, until they change their server-side checks.

You don't need ZOS to tell you that, anyone who creates software can tell you that.

So I imagine the only thing they have to go on is reports from players and people that adjust the values so rediculous their anti cheat detector thingy (for lack of a technical term) picks up some inconsistencies .

yumyum · June 2016

Cuyler wrote: »

Nifty2g wrote: »

Roehamad_Ali wrote: »

Look , fellas , they're not gonna go into detail anymore . They already said they're being vague on purpose . I seriously doubt you're gonna get an answer on perma bans being lifted or what they can or can't do to catch cheaters anymore after that statement . It's a waste of energy to keep shoving the microphone in their face for more clarity .

We do not want information on the perma bans. We want information on this program being used and what is being done about it's uses. Seems like people can still use it from no comments about it

This is exactly what everyone I talk to and myself would like to know. Can they still use Cheat Engine or not. And when will ZOS eliminate the opportunity to do so. I could care less HOW they do it, as long as it's done. Confidence will remain low until such time.

ZOS is never going to give you that information. Anti cheat is not just about detecting cheats or stopping players from using a tool or a cheat, it is also about the fear of the unknown for the player who thinks he or she may have a go at cheating.

Cheat engine is very easy to detect but that comes down the the anti cheat system, in the games that i work on i detect 700 - 1000 plus players a month using cheat engine, i don't know what AC ( Anti cheat ) ZOS is using so it could be a lot harder for them.

yodased · June 2016

Roehamad_Ali wrote: »

yodased wrote: »

@cuyler yes 100% cheat engine or any other memory scanner/modifier will still work with this game. It will continue to work with this game forever, until they change their server-side checks.

You don't need ZOS to tell you that, anyone who creates software can tell you that.

So I imagine the only thing they have to go on is reports from players and people that adjust the values so rediculous their anti cheat detector thingy (for lack of a technical term) picks up some inconsistencies .

Exactly, they rely on reports so they can then go into the server log and check for values. Once a human looks at it, its pretty clear to see a person plot points trends a % over the populous and they are cheating, but to try and grab that data without specific inputs and queries is nigh improbable.

I do have an actual solution to this problem though and its actually really simple:

Require the launcher to be used to start the game and be open during the game, the launcher will act as intrusion detection and monitor processes from the game with a trust matrix built in. If they see a process running in the windows system, do not allow the exe to run. If the exe is running and the process is started, close the exe

This would have to fix the memory leak on the launcher, but this would 100% close the loop of cheat engine specifically.

It wouldn't stop memory hacking, but if you are writing machine code to hack ESO, you deserve to hack ESO.

Rohamad_Ali · June 2016

yodased wrote: »

Roehamad_Ali wrote: »

yodased wrote: »

@cuyler yes 100% cheat engine or any other memory scanner/modifier will still work with this game. It will continue to work with this game forever, until they change their server-side checks.

You don't need ZOS to tell you that, anyone who creates software can tell you that.

So I imagine the only thing they have to go on is reports from players and people that adjust the values so rediculous their anti cheat detector thingy (for lack of a technical term) picks up some inconsistencies .

Exactly, they rely on reports so they can then go into the server log and check for values. Once a human looks at it, its pretty clear to see a person plot points trends a % over the populous and they are cheating, but to try and grab that data without specific inputs and queries is nigh improbable.

I do have an actual solution to this problem though and its actually really simple:

Require the launcher to be used to start the game and be open during the game, the launcher will act as intrusion detection and monitor processes from the game with a trust matrix built in. If they see a process running in the windows system, do not allow the exe to run. If the exe is running and the process is started, close the exe

This would have to fix the memory leak on the launcher, but this would 100% close the loop of cheat engine specifically.

It wouldn't stop memory hacking, but if you are writing machine code to hack ESO, you deserve to hack ESO.

I have Zero Skills in this area . It took me two years to get my VCR clock to stop blinking in 1989 . But what you wrote sounds technical and believable to this wrench turner , so I give you an awesome in case you save Tamriel with this fix one day .

Ch4mpTW · June 2016

yodased wrote: »

@cuyler yes 100% cheat engine or any other memory scanner/modifier will still work with this game. It will continue to work with this game forever, until they change their server-side checks.

You don't need ZOS to tell you that, anyone who creates software can tell you that.

Truth! The sad thing is that you easily setup the architecture up to check and reject things like C.E. No lie, I could probably whip up something to do so in like 5 or 7 days working with the server and everything. I kid you not. It's juvenile how easily this could be done. And I promise you it wouldn't effect lag in the slightest.

So what these developers who wrote the software are doing and have been doing is beyond me. And any ZOS developer who looks into this thread, and wants proof? I got you. Hit me up with a message. I'll show my certifications and credentials as well. Plus I'll provide the contact information of my previous clients, so you can cross-check my information if you still weren't trustworthy of my background in programming and software integrity and security. Plus, I'd do it for free. Just because I value the community enough, and feel they should be receiving top-notch software. So you wouldn't even have to cut me a check. I'll do it just off the jump for my love for the community.

yodased · June 2016

@roehamad_ali

LoL that isn't something I just came up with, it's basic anti-intrusion. There are a few ways around this problem:

1. Never trust the client, so you always store sensitive data on the server only.
The client is readonly. This is done on games like gta V, the client literally is a presentation layer only, but this server arch can't handle that, so buhbye.

2. Encrypt your variables and then decrypt them server side.
This is more fesible, but it requires a two step process and depending on where you keep the keys, its trivial to unlock.

3. Sanity checks
This is more in line with what most online games do. They send a specific query to the client with a specific expected answer. If that answer is out of bounds, they are cheating. For instance, you could do something like on character load, bring all resources to 0, then start regen timer. Depending on the variables send back by the client, you would have a specific answer from the server as to the time to 100. If that time to 100 is faster, there is an issue, drop the client.

4. Memory scanning;
This is my idea above. Basically you include 'cheat engine' within the launcher and you watch the hooks from windows that the program will attach to. If you see activity along that BUS, kill the client.

There are more in my head, but I would start with one of them for sure.

NewBlacksmurf · June 2016

yodased wrote: »

@newblacksmurf

It's a broken record. I have been involved in this game since april 2014. There are other. smarter guys and gals that have been here longer also talking about it.

I have mentioned cheat engine, by name, at least 20 times in the last 2.5 years, both in direct conversation with green text as well as here in the forum.

The end result is the same:

the server does not check the client enough so there never can be a way to stop memory hacks.

I'm sure that ZOS hates the fact that there server architecture isn't set up in a way that they can monitor network activity on a granular level, but it is what it is.

Tell you what though, I played for a year on PS4 and I never once thought "How the *** did I just die"? I was on PC this week again since I missed my awesome guildies and I have had over 10 moments of 0.o thats ***, no way that is legit

take that for what its worth, but you don't have 3-4 dizzy swings, two executioners and a ferocious leap hitting you in < 3 seconds on console.

@yodased
I think we share a very similar perspective
I have not provided any details on how this stuff works and that is far outside of my talent but I've been around since early 2013in the PC closed BETA phases and guess what.....as you describe.

Heck it may have been your post along with others with very detailed feedback on server changes and security.
This was prompted by two main things back then
-BOTs
-Server lag in PvP as well as due to what addons could pull and after ZOS changes what they couldn't pull

But on console- Xbox One, when I made the copy over, I recall in the first week playing in PvP where ppl had what seemed to be unlimited ultimate casting abilities. I was like...how the heck are ppl cheating like this on console, that is why i left PC

Then I had ppl literally show me they could do it.....I paused and then asked....O K can I do this without using an exploit.
They said yes and showed me.

Seems as many kept saying, the server side checks were not happening so for some weird reason, the ultimate would pop on the screen and then cast...but no recognize that it was cast server side the the ultimate still existed.

And I mean in an extreme measure where we were doing a Craglorn dungeon with 3 ppl at VR6 or so and cast an ultimate 5 times letting it hit, expire and casted another before it registered server side.

So with 3 ppl, that 15 ultimate's over 1-2 minutes.
I was killed like that many times in PvP and its one reason why I don't even play PvP at all. There are other reasons too but since ZOS doesn't seem keen on quality, why should we face frustrations.

Now this has sense been "fixed" so to speak for Templars ultimate but it existed in console beta and then went to live and existed for months.

Publius_Scipio · June 2016

I think this topic warrants a few minutes of mention on the next ESO Live. I think the players deserve at least that.

Ch4mpTW · June 2016

yodased wrote: »

@roehamad_ali

LoL that isn't something I just came up with, it's basic anti-intrusion. There are a few ways around this problem:

1. Never trust the client, so you always store sensitive data on the server only.
The client is readonly. This is done on games like gta V, the client literally is a presentation layer only, but this server arch can't handle that, so buhbye.

2. Encrypt your variables and then decrypt them server side.
This is more fesible, but it requires a two step process and depending on where you keep the keys, its trivial to unlock.

3. Sanity checks
This is more in line with what most online games do. They send a specific query to the client with a specific expected answer. If that answer is out of bounds, they are cheating. For instance, you could do something like on character load, bring all resources to 0, then start regen timer. Depending on the variables send back by the client, you would have a specific answer from the server as to the time to 100. If that time to 100 is faster, there is an issue, drop the client.

4. Memory scanning;
This is my idea above. Basically you include 'cheat engine' within the launcher and you watch the hooks from windows that the program will attach to. If you see activity along that BUS, kill the client.

There are more in my head, but I would start with one of them for sure.

@yodased
Very true. I'm assuming you and @cuyler are both programmers as well? Or people who handle cyber forensics? Offensive security? Breech testing? By the way, what you posted applies to not just video games but a lot of software in general. Lol. It's pretty basic trivial stuff really, so why ZOS hasn't implemented something like this but to a higher degree is beyond me.

Xjcon · June 2016

There is so many questionable things going on in the game it's sad. I really hope the people using the CE software feel like it's OK to keep using it, and at some point when ZoS finally figures out how to detect people using it they drop the ban hammer again.