Gabe Newell Talking About VAC Update

[_kyle_ 318]

http://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/

[Ichalvl 1752]

Posting it here for anyone who doesn't want to view the reddit page (Or in case of deletion):

 

Trust is a critical part of a multiplayer game community - trust in the developer, trust in the system, and trust in the other players.  Cheats are a negative sum game, where a minority benefits less than the majority is harmed.  

 

There are a bunch of different ways to attack a trust-based system including writing a bunch of code (hacks), or through social engineering (for example convincing people that the system isn't as trustworthy as they thought it was).

 

For a game like Counter-Strike, there will be thousands of cheats created, several hundred of which will be actively in use at any given time.  There will be around ten to twenty groups trying to make money selling cheats.  

 

We don't usually talk about VAC (our counter-hacking hacks), because it creates more opportunities for cheaters to attack the system (through writing code or social engineering).

 

This time is going to be an exception.

 

There are a number of kernel-level paid cheats that relate to [this Reddit thread](http://www.reddit.com/r/Games/comments/1y1uuc/vac_now_reads_all_the_domains_you_have_visited/).  Cheat developers have a problem in getting cheaters to actually pay them for all the obvious reasons, so they start creating DRM and anti-cheat code for their cheats. These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat.

 

VAC checked for the presence of these cheats.  If they were detected VAC  then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache.  If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check.  570 cheaters are being banned as a result.  

 

Cheat versus trust is an ongoing cat-and-mouse game.  New cheats are created all the time, detected, banned, and tweaked.  This specific VAC test for this specific round of cheats was effective for 13 days, which is fairly typical.  It is now no longer active as the cheat providers have worked around it by manipulating the DNS cache of their customers' client machines.

 

Kernel-level cheats are expensive to create, and they are expensive to detect.  Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain.  

 

There is also a social engineering side to cheating, which is to attack people's trust in the system.  If "Valve is evil - look they are tracking all of the websites you visit" is an idea that gets traction, then that is to the benefit of cheaters and cheat creators.  VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky.  For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.

 

Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy.

 

Q&A

 

1)  Do we send your browsing history to Valve?

No.

 

2)  Do we care what porn sites you visit?

Oh, dear god, no.  My brain just melted.

 

3)  Is Valve using its market success to go evil?

I don't think so, but you have to make the call if we are trustworthy.  We try really hard to earn and keep your trust.

Edited February 18, 2014 by Ichalvl

[AntyCrix 591]

 

Posting it here for anyone who doesn't want to view the reddit page (Or in case of deletion):

 

Trust is a critical part of a multiplayer game community - trust in the developer, trust in the system, and trust in the other players.  Cheats are a negative sum game, where a minority benefits less than the majority is harmed.  

 

There are a bunch of different ways to attack a trust-based system including writing a bunch of code (hacks), or through social engineering (for example convincing people that the system isn't as trustworthy as they thought it was).

 

For a game like Counter-Strike, there will be thousands of cheats created, several hundred of which will be actively in use at any given time.  There will be around ten to twenty groups trying to make money selling cheats.  

 

We don't usually talk about VAC (our counter-hacking hacks), because it creates more opportunities for cheaters to attack the system (through writing code or social engineering).

 

This time is going to be an exception.

 

There are a number of kernel-level paid cheats that relate to [this Reddit thread](http://www.reddit.com/r/Games/comments/1y1uuc/vac_now_reads_all_the_domains_you_have_visited/).  Cheat developers have a problem in getting cheaters to actually pay them for all the obvious reasons, so they start creating DRM and anti-cheat code for their cheats. These cheats phone home to a DRM server that confirms that a cheater has actually paid to use the cheat.

 

VAC checked for the presence of these cheats.  If they were detected VAC  then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache.  If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check.  570 cheaters are being banned as a result.  

 

Cheat versus trust is an ongoing cat-and-mouse game.  New cheats are created all the time, detected, banned, and tweaked.  This specific VAC test for this specific round of cheats was effective for 13 days, which is fairly typical.  It is now no longer active as the cheat providers have worked around it by manipulating the DNS cache of their customers' client machines.

 

Kernel-level cheats are expensive to create, and they are expensive to detect.  Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain.  

 

There is also a social engineering side to cheating, which is to attack people's trust in the system.  If "Valve is evil - look they are tracking all of the websites you visit" is an idea that gets traction, then that is to the benefit of cheaters and cheat creators.  VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky.  For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.

 

Our response is to make it clear what we were actually doing and why with enough transparency that people can make their own judgements as to whether or not we are trustworthy.

 

Q&A

 

1)  Do we send your browsing history to Valve?

No.

 

2)  Do we care what porn sites you visit?

Oh, dear god, no.  My brain just melted.

 

3)  Is Valve using its market success to go evil?

I don't think so, but you have to make the call if we are trustworthy.  We try really hard to earn and keep your trust.

 

 

Why would this post be deleted?

[Rayne 4478]

Why would this post be deleted?

 

Does it really matter? 

[AntyCrix 591]

Does it really matter? 

 

Well he's reposting it basically for his post count. It's nothing but useless, in reality. Just click the link to read the damn thing.

[Rayne 4478]

Well he's reposting it basically for his post count. It's nothing but useless, in reality. Just click the link to read the damn thing.

 

I wouldn't of read it unless he posted the copy & paste... 

[AntyCrix 591]

I wouldn't of read it unless he posted the copy & paste... 

 

That makes you lazy

[Rayne 4478]

That makes you lazy

 

No arguments there. 

[Sean 3760]

Some people can't view reddit at school/work. boondock.

[Rayne 4478]

Some people can't view reddit at school/work. boondock.

 

This would have been a better answer! 

[Joscal 339]

Nothing like arguing about post counts to increase post counts.

On topic: Good direction.

[Rayne 4478]

Nothing like arguing about post counts to increase post counts.

On topic: Good direction.

 

Nobody is arguing about post count... Just logic, or lack of.

 

+1? 

[ctark 1983]

I didn't hear the orig rumor that vac was taking over the world and stealing your dns shiznit, but I'm glad they took the time to clarify that.

 

Also having a copy paste is always nice, even if it's just partial, enough to entice me to read the article.