Open Arena Aimbot

[grey matter]

Uhm, a third-party service which does not even have a proper description for unregistered users? No thanks, I like to keep local backups anyways. I assume they're working with IPs, so this is not of much use (otherwise we wouldn't have discussed on multiple pages).

If they are indeed interesting, don't hesitate to leak their "secret" way of operating

[PopeJo]

Missing the ability to edit the game logic is a big limitation, and so I can't see the point to choose QL over another open game. There are so many out there, and some great ones such as OA, why spend so much pain in a closed game?

Because it has anti-cheat, global bans, stats and match-making system? Also see above for fan projects, those usually only emerge for great games, where the closedness (is that a word? it's late..) does not matter that much.

QL does not have any anti cheat system. For more then one year admins say "there will be" an anti-cheat system. they wont tell when the system goes online and what it does.
so far there is none and cheaters are banned when reported by other users and admins confirmed the suspicions.  

the esr and ql forums as well as the ql irc channels are full of frustrated users demanding an anti-cheat system from id software.

(punkbuster does not seem to be an option. it was there in the beta-stage, but it was so buggy, it kept way more normal players from enjoying the game then exposing and blocking cheaters)

[GrosBedo]

@PopeJo: thank you for this interesting piece of information. So QL share the same problem as OpenArena, except that in OA there isn't yet a global banlist. With such a system, we should be on par in this domain. And who knows, maybe OA can surpass QL in the future in cheating detection?

@grey matter: metabans isn't in opposition to the 7's suggestion to make a certificate system to identify users and limit abuses, the two are complementary.
Metabans can work standalone (meaning that you can manually upload your banlist, and download other admins' banlists), but it can also be totally automated using third-party tools, like B3, and this is by far the main advantage. Plus, it has a field to store reasons (which B3 support natively), and a different table to watch players instead of punishing them right away.

This is nothing very innovative technologically, but the concept resides in the web interface that allows for easy sharing and subscription to other's banlists. In this sense, I think it's a very nice tool (and great if it works well, it's still in beta as of January 2012).

About your concerns for privacy, the banlists are anyway to be downloaded on your server, the game engines can't just connect directly to metabans to apply bans. Metabans is only to be used to share, not to apply, so you always have a full backup on your server anyway. Secondly, I trust the author Phogue because he seems to know one of the main dev of B3 that I deeply respect, so for now I give him the presumption of innocence and of good intention.

---------------------------

Also, there was a previous discussion one year and a half ago about the very same issue, with some related proposition (in fact there are mines which didn't change). There is also a patch to authenticate users using a GUID with a RSA 2048 bits key, this might be useful to make a stronger certificate system.

http://openarena.ws/board/index.php?topic=3206.75

[7]

The certificate system's encryption doesn't need to be very strong because the certificates are little more than vapor themselves What I mean by this is that because the certificates are issued to anonymous clients which can fake their uuids and change their ips, the certificates aren't very trustworthy in the first place, so they should expire literally within minutes (the more you trust the data on a certificate, the longer the certificate can last before you make it expire). The encryption on the certificates needs to be broken before they expire to be useful for a cheater, and it has to be very weak indeed to be broken within minutes.

To make the system really annoying to cheaters, the initial tempban time on a certificate should be longer than the time the certificate is valid to play with. This way the clients must maintain a "chain" of certificates before they start playing or they can only play a few minutes before being disconnected. Because cheaters have to maintain more  chains of certificates concurrently, they're easier to detect by the signing server (which could write the number of concurrent uuids from the same ip on the certificates so the OA-servers can take action if needed).

I'm thinking about an initial tempban time of 15 minutes and a playing time of 5 minutes on a certificate, this way a player has to request a "chain" of 3 certificates a bit earlier then 15, 10 and 5 minutes before he starts playing online to be able to play uninterrupted. (One could write a little service program that runs in a players system tray and maintains a certificate chain as long as the player's machine is online, which would alleviate a lot of the hassle with tempbans for honest players.)

Edit: a stroke trough the unwarranted conclusion.

[RMF]

I'm sending Edit: I've sent an e-mail to abuse@mediafire, I hope they'll remove it.

Yay!
"The file you requested has been removed from MediaFire for a violation of our Terms of Service or our Acceptable Use Policy"

It was also on his youtube channel, but I couldn't take that one down (I tried actually). I'm glad the downloadlink just got removed altogether ^^.
Btw it was actually removed 7 days ago, but somehow it ended up in my spamfolder and it got pushed down by the loads of spam I'm getting last week.

[swaggerall]

king orgy bot is trash anyway...

[Corvette]

I can beat even the toughest Nightmare bots in single player mode on Agressor, which is probably the toughest map to beat them on since it has no pits that they keep falling in (I use no aimbot BTW). On maps like DM4ish or any map where they tend to fall in pits, they tend to defeat themselves. I find LAA-LAA to be the toughest bot to beat.

One thing I noticed with some people is I used to catch people using aimbots upon spectating them but now I notice that some people I suspect of using an aimbot seem to stop using an aimbot and their skill level drops when being spectated. Some people I suspect of using one simply leave upon being spectated. It would be trivial for someone to write an aimbot that simply turns itself off upon being spectated. Perhaps what we need is an Rcon Spectate so that we can spectate someone without possibly alerting their client (and possible aimbot) that they are being spectated.

One person I sometimes suspect of using an aimbot is C++ (who often enters with various different nicks). IIRC, he's had a history of using them (and being kicked out of various servers for it) and when I spectated him the last (two?) time(s) he shortly left afterwards. The last time he was beating me like 20 to three (and everyone else even had zero) and I've been

A: Playing considerably longer than he has

B: This is a guy who still doesn't really know how to strafe jump (though I'm not exactly the best strafe jumper myself, not by a long shot), I've at least spent some time practicing on some of those practice maps. I've seen him practice and he still has problems overcoming the first few easiest blocks.

When he was caught using an aimbot earlier on he promised that if he gets unbanned he would never use one again but sometimes I wonder.

I don't want to prematurely accuse him of it again but I have spectated a few people using them before and sometimes I suspect people of using it only when not being spectated. So if there were some way for those with Rcon to spectate without anyone knowing, it could be a good thing.

[grey matter]

Rcon is a text-only system to control the server. How would you spectate someone with that?

If you wan't to have invisible spectators in game, they either must now show up in the scoreboard and ingame at all or they must be listed as a normal (free,red,blue) player.
You can currently test whether you're being spectated by looking at the scoreboard to see spectators. Depending on g_truePing, someone spectating you will always have the exact same ping as you.

While I think that invisible spectators require quite some hacks code-wise, why not just record server-side demos and review them later? This is opaque to the clients, unless the server prints a huge message about it

[GrosBedo]

B: This is a guy who still doesn't really know how to strafe jump (though I'm not exactly the best strafe jumper myself, not by a long shot), I've at least spent some time practicing on some of those practice maps. I've seen him practice and he still has problems overcoming the first few easiest blocks.

Exactly, the decorrelation between a player's aim skills and strafing skills is a perfect example of feature that can help a lot in detecting cheating players.

About your question of making an invisible rcon player, there are two solutions:
- Recording server-side demos, by patching the server's binaries (like what grey matter proposed).
- Connecting a GTV server that will be watching the server continuously, and players connected to GTV can't be seen by playing players.

And about the player you are reporting, this seems to me to be a totally plausible and logical behaviour from a spotted cheating player, who still cheat but more carefully now.

[Bane]

LOL corvette I guess I know why you when spec so much last night . Anyway corvette I was just wonder do you seem to get some weird lag when he is on there just curious

[Corvette]

LOL corvette I guess I know why you when spec so much last night . Anyway corvette I was just wonder do you seem to get some weird lag when he is on there just curious

I did notice the server intermittently lags, though I haven't (yet) made the potential connection between server lag and his presence. It's possible that he's doing something to lag the server? (through some twisted form of a DDOS attack?). I'll pay closer attention from now on.

Regarding being able to spectate secretly, Digichalk is not my server (I don't even have rcon there, though I know Sitting Duck does) so I wouldn't be able to do any of what you guys are saying. However, those who set up servers appoint moderators to moderate, it sort of makes sense to give those moderators with rcon the tools necessary to moderate the servers well, such as an rcon spectate command that will allow moderators to spectate in secret. I know aimbots haven't traditionally been a problem with Open Arena and so this probably wasn't thought of early on but they do seem to be a growing concern.

[added in edit]

After entering the server without him there, I notice the server seems to lag anytime anyone else enters. I don't think his presence is related to the server's recent lag, I think it's caused by too many people, though it never had these problems before.

[WaspKiller]

...One thing I noticed with some people is I used to catch people using aimbots upon spectating them but now I notice that some people I suspect of using an aimbot seem to stop using an aimbot and their skill level drops when being spectated. Some people I suspect of using one simply leave upon being spectated. It would be trivial for someone to write an aimbot that simply turns itself off upon being spectated...

It's called "toggling" and cheaters started doing it shortly after the 1st cheat was made for Q3 in 1999.


However, I throw my hands up when it come to the Skull-Bots... I may even have to leave OA and E+:

http://www.newscientist.com/blogs/onepercent/2012/01/curious-robots-learn-to-intera.html?DCMP=OTC-rss&nsref=online-news

[GrosBedo]

Just found a similar topic in the Tremulous forums (from 2007):
http://tremulous.net/forum/index.php?topic=5386.0