Delayed Bans

[GreenBean-HH-]

I was reminded by Lil B_F's post on VAC (HERE (http://www.hackhunters.com/forum/index.php?topic=290.0)) of an idea we had at the beginning of HackHunters formation regarding the delay of banning cheaters. Here's the idea and why it works:

SCENARIO: A cracker makes a new hack for a game, goes on a PB enabled server to test it and work out the bugs. When they see that PB doesn't 'see' it, they release it to their community where others jump in and start using the hack as long as they can before PB catches up and starts imposing bans. Once a few bans are made by PB, people within the hackers community spread the word and the majority of people stop using the hack on PB enabled servers.

DELAY BANS: Okay, say PB or other streaming services discover a new hack and write software to stop the new threat. Typically they will implement the new software to make instant bans on anyone caught using the hack. Instead, we suggest collecting data on anyone and everyone that is using the hack for a period of time, say 2 to 5 weeks (or depending on how many are using the new hack), and then make sweeping bans of all individuals who are using the hack. This way AC's can catch everyone that is using the hack and not just a few unlucky hackers.

CONSEQUENCES: This would obviously have a greater impact on hackers community as they would never know if a hack was already discovered or not, leading to more people being reluctant to use hacks for fear of having to repurchase the game. It would also cast a larger net over hackers... the AC's spend a lot of time creating Anti-Cheat software, this system would allow that software to have a greater impact, thus making it more useful.

Cheaters do not mind it when a few of their comrades are caught using a hack they've created... they just don't care about the individual that was caught and at the same time they will use that information to put out warnings or to make changes to the software. Not implementing a delay ban is helping crackers discover any weaknesses in their hacks.

[Killian]

Not sure if i am allowed post but, what a great idea, blanket banned, I like :D

[GreenBean-HH-]

Everyone is welcome to post, thanks for your input.

If you have any ideas, suggestions, questions, comments, thoughts, gestures, confusions, blockages... need i go on? POST.

:D


;D

[!AR!BlackHawk]

New hacks never get caught before release, but after release (3/6 weeks, if at all) so you aready got this effect :)

[GreenBean-HH-]

The real issue is getting more servers streaming PB and other AntiCheats so that more ppl will be picked up.

The question isn't the natural delay AntiCheat software has in regard to releasing catches, it is are they releasing it when they can catch the majority of cheaters based on the numbers of cheaters using the cheat... i.e., checking stats.

This brings up another idea I had...

TURNING an PB Stream OFF (with PB. THEN BACK ON.
I'm wondering if Admins turned off their PB periodically and during a full server or when it's obvious that someone is cheating, turned it back on to not only catch the cheater(s) but to register their GUID on Master Ban Lists.

SCENARIO: A cheater looks for servers not streaming PB... finds one, joins the game and thinks they're 'cleaning up' on everyone. Then PB is enabled along with PBBans, AON, etc. and surprise, BAN!

Is this possible?

[Killian]

I am doing it at the moment, that is why we have been catching a lot of hackers! Would not believe the joy it brings :D! Watch Saturday, pb will be very busy lol :D:D:D:D

[Sneaky]

yea its a command that you can do. you need enough pb player power to do it.

[Frag]

Good idea Greenbean! People are so concerned with keeping hackers off their servers that they want it streaming continuously. If people turned PB off for a couple hours at least then back on there would be a lot more hackers getting busted!!

[RoadWarrior]

Personally, I would never turn pb off, even for a little bit. Streaming services such as PBBans and PsB require that you be running pb at ALL times, or your streaming is stopped. Those that do stream, would see an interruption in their services from said-streaming sites, and as a result, no streamed-logs, no bans, then turn it back on, have to re-enable the service, and hope for the best. That is perhaps a bit of a backward idea, really, and no offence meant by that, fyi.

Anti-cheat is all about reaction, not prediction. New cheats come out every single day, for various games. Getting our hands on them, then breaking them down, and finding out how they tick, is what makes the cheat(s) detectable via MD5 and cvar/dvar scans, depending on the game.

No AC-site that I know of, with any reputation, would advocate that you go out and purchase a cheat just to see it detected, fyi, and I personally will not encourage you to do so, in fact, I would rather implore that you do not! ;)

Thing of it is, is that a cheat, once released, very rarely goes past a few days, or even a week, of usefulness, before it is detected. Don't let them make money off of you, someone always seems to turn it in. Once it is, it's not long before detections are added for it, in various ways, and it becomes useless on servers that use repute-able streaming services.

Dis-abling PB, even for an hour or two, also disables evenbalance from learning more about the cheats in use, and potential detections, as they have their own logs working at the time.

Be a part of the solution. ;)

[GreenBean-HH-]

Hi RoadWarrior,

Thanks for posting.


No AC-site that I know of, with any reputation, would advocate that you go out and purchase a cheat just to see it detected, fyi, and I personally will not encourage you to do so, in fact, I would rather implore that you do not!

I don't think we ever said go out and buy a cheat to test it... that is not our policy. We don't accept cheats or test cheats... period.

As far as streaming PB, then turning it off... you make a good point and I'm glad you posted. If there is a problem, as you pointed out, then by all means leave it streaming. I think most servers stream PB anyway...

I think we are 'part of the solution' ;) HunterBean SOUP is just to throw ideas around. Nothing here is part of any policy. Thanks for the contribution as your comments provide a view point we appreciate hearing about.