Cheat or death? The secret world of malware-like cheats in video games

[harlan4096]

Fortnite? Overwatch? League of Legends? If you’ve heard of these games but don’t know an aim-bot from a wall-hack (let alone ESP), read on to understand why some ordinary folks feel like a fish out of water in competitive matches — and why that matters.

As of 2018, video games represent one of the most lucrative businesses in the world, generating more than $43 billion in revenue in the United States alone. An entire media ecosystem has sprung up around the gaming industry, with e-sports or electronic sports tournaments broadcast on cable television attracting nearly 400 million viewers each year. Streaming platforms such as Twitch and Mixer add even more viewers to the mix.

Contrary to stereotypes involving teenage boys and young men, ESA (Entertainment Software Association) research indicates that in the US the average gamer is 34 years old, and women represent 45% of the demographic. A leading factor when deciding which video game to purchase these days is online game-play capability, which enables developers and publishers to charge a subscription fee and provides players with a competitive arena to test their abilities against ranked opponents.

Video game cheats are nothing new, but now, among the great variety of performance enhancing cheats we are seeing cheats that demonstrate malwarelike behavior, using evasion features and techniques that rival those of advanced persistent threats.

What is video game cheating, and how does it affect the industry and other players?

In the context of today’s massive multiplayer and online games, cheating can give a player unfair advantage over actual opponents. It spoils the fun for everyone and causes direct (by cheating) and indirect (through attrition) financial losses for game companies that can’t seem to stop them.

No one taxonomy exists for the classification of cheats, but very broadly, two categories of cheat exist for online video games: exploitation of technical vulnerabilities in the client, the server, the environment, or the game; and fraud through compromise of the privacy or security of other players, or by insider manipulation. Unsurprisingly, these two kinds often go hand in hand.

A gray market emerges

For years, stolen game items or credentials were available even at well-known auction sites such as eBay. Nowadays, specialized virtual item websites have emerged to serve players seeking shortcuts to level up or obtain game items. The economy includes virtual sweatshops in which someone else takes over the player’s account to perform dull or repetitive tasks — and that’s only the tip of the iceberg. In addition to selling cheats, some online communities trade and resell hacked accounts for games, VPN providers, and pornography websites.

One of the most infamous cheats serves to show the magnitude of the cheat market: WoWGlider, a bot developed by MDY Industries for the game World of Warcraft, which at its peak gathered 12 million players in a virtual world. WoWGlider sold more than 100,000 copies for $25 each, making this single cheat a multimillion dollar enterprise.

As with ransomware, sometimes fighting cheat developers using legal resources means a long and tedious process under the laws of more than one country — and even if the immediate result is positive for the game publisher, nothing stops other individuals from taking up the torch, promptly replacing one cheat with another.

Surfing the ban wave

During January 2019, Valve Corporation, creator of the digital distributor platform Steam and popular games such as Counter Strike, Dota 2, and others, banned more than 1 million accounts in what is known as the biggest ban wave ever to hit Steam (so far).

Still, communities are riddled with messages complaining about the number of cheaters increasing and ruining the game.

Valve’s digital download market and community registered 125 million users as of 2018, remaining the dominant PC games distribution platform. Steam offers publishers and developers a straightforward and familiar environment for monetizing their creations.

One of the features that helps Steam maintain its lead as an online gaming platform is the VAC (Valve Anti-Cheat) system, which seeks out cheats installed on users’ computers and bans those users. Even if new accounts are easy to obtain, unless the user provides some form of verifiable information such as a credit card or a phone number, the platform’s functionality will be greatly reduced.

The way anticheating engines work remains unclear; security through obscurity appears to be an essential component to keep cheaters in the dark about how detection is being made. However, even doing a simple Web search has caused some anticheating solutions to prohibit players from joining a game after memory scans detected words such as “cheat” and flagged the suspicious activity. Valve’s VAC was accused of inspecting DNS queries made by the user, even prior to launching any game from the platform.
...

Continue Reading