3

I was wondering. I observed most of any MMO that are hack-prone area. Hacks used one-hit kills, stealing accounts, instant level up, aimbots (mostly MMOFPS), and questionable wallers (also in MMOFPS). These hackers might affect the fairness and excitement of the gamers which lead to doubts, abuse kickers (mostly in MMOFPS*, and misunderstandings. Even in MMORPG referred to hacks for instant money for purchase items. I saw these examples via Wikipedia.

This leads me to my question:

Which kind of MMO game platform or model would be best for making MMO games whilst reducing the possibility of hacking?

For example I could make an MMO game for the web browser (by website or via Facebook) or making an MMO game using installers/clients that fetches for patches and graphics that could run only through program via computer. What will help with preventing hacking and how?

In the case of making an installer/client based MMO games, are there anti-hack programs or techniques you can recommend in MMO context?

Tom 'Blue' Piddock
  • 3,637
  • 1
  • 27
  • 42
David Dimalanta
  • 1,439
  • 2
  • 17
  • 37
  • 2
    Browsers-based technologies aren't more or less hack-proof than native applications. – Philipp May 03 '13 at 07:15
  • 2
    There's a lot of text here but how much of it is really specific to your question? – Tetrad May 03 '13 at 07:42
  • 1
    @Tetrad it seems only the first and last 2 paragraphs contain a question the rest is just fluff – ratchet freak May 03 '13 at 07:59
  • Observing and study making an MMO game by trying one of these MMO games, @Trevor Powell. I took any four MMO games (Uberstrike, CrossFire, Mercenary Online, and Rush Team) to see if one of these games have probability of encounter a cheater in a game or not. I have two other possibilities: making a better hackless MMO game or contribute an anti-hack/anti-cheat app for one of these MMO games are highly prone to hacking. I wonder. – David Dimalanta May 03 '13 at 08:57
  • Both @jwenting's answer and Philipp's answer are both reasonably correct. However, I don't want being bias to them once I put a checkmark on one of their answer. I decided to vote up on both. – David Dimalanta May 10 '13 at 02:18

2 Answers2

8

Whichever you do, it doesn't matter. If you rely on clientside calculation of anything you will get hacked. All the "anti-hacker" tooling has AFAIK been thoroughly penetrated, new versions often themselves being hacked in a matter of hours after release.
Given that, browser games are a major PITA IMO (poor usability) though they do offer ease of installation.
So push as much as you can to the server, validate and counter validate everything sent by the clients to the server, and aggressively detect and ban any violators.
Of course you do have to account for lag which can cause weird results being sent (or received), which is another reason you don't want to rely on clientside anything.
So the client tells the server he's moving in direction alpha, let the server decide the next position, not the client. Client tells the server he's pulling the trigger, let the server decide whether there's bullets left, where they're going, and whether anything is hit (and what damage they do).
Done like that, the client becomes little more than a tool for rendering the world and allowing the user to request things (data, movement, etc.) from the server with the server deciding whether those requests should be honoured based on what it knows about the real abilities of the client (this also makes it impossible to render walls invisible for example, unless the client avatar is known to the server to have X-ray vision, a decision made based on gameplay and resources the server assigned to the avatar, not the client software).

Of course this places a major burden on the servers, your server hardware is going to have to be rather more serious than that of old fashioned gaming servers which were little more than portals to transmit data between clients, but that's what it takes to deflect hacking/cheating attempts.

jwenting
  • 442
  • 2
  • 5
  • It's quite complicated as it seems! Tell you what, when most users saw the announcement of upcoming updates for a certain MMO game, most users expect that after server maintenance all the cheaters and bugs will wipe-out in an instant. That proves wrong and the hackers are still coming back again and again. Most users are kept complaining until they decided to play a different MMO games with stronger anti-cheat, rarer encountered of the cheaters, or games that are lame enough so most hackers probably ignored it. Is the anti-cheat nearly useless no matter how powerful this anti-hack was? – David Dimalanta May 03 '13 at 06:21
  • Also, if anti-cheat is not effective, should I only rely on brute-force algorithm to trace who is behind on hacking to winning? That would be approximately 10,000 hackers to be caught everyday.

    Also, aside from anti-cheat, is there a virtual surveillance that lets the admin and spy program teams to monitor each game server of an MMO game for some weird actions? When an admin saw a user doing flying-hacks, for example, via virtual surveillance, it will automatically gave a probation or else permanently ban the user? How effective is this one?

     – David Dimalanta May 03 '13 at 06:35
  • 2
    read again, concentrate your efforts on ensuring any hacks players perform on their clients will not influence what happens on the servers (and thus other players, or their own scores). That will guarantee that players can't cheat by using hacked clients, the only changes they will be able to make will be cosmetic changes that only they themselves can see. – jwenting May 03 '13 at 11:39
2

Anti cheat tools are software, just like the game client itself. Just like a hack is able to manipulate the game software, it can also manipulate the anti cheat software.

Any software which runs on the users machine is under their control. For that reason it is physically impossible to create unhackable client-sided anti cheat tools. When you want your game to be impossible to hack, you have to move any calculations which are worth manipulating to the server.

  • Don't send information to the client the user isn't supposed to know (like enemies behind walls)
  • Don't trust the client when it reports its location or any other game state information - only receive input commands and then tell the client the results
  • Do any collision- and hit detection on the server.
  • Save, maintain and persist the game state on the server, not the client (When a game allows the client to increase its cash shop credits without a server confirmation, the developers seriously don't know what they are doing).

When you do all that, the only thing which a client-sided hack is still able to do, is automation (like an aimbot). Unfortunately there isn't much you can do about that, except for a heuristic approach to detect unusual input on the server.

There is, however, a drawback of doing everything on the server. The more you do on the server, the harder will it be for the client to hide latency problems. Modern online game clients do a great job at extrapolating object movements, hiding discrepancies between client and server and combensating for latency. But the more information you hide from the client, the less information is available on the client for doing all that. And when you do everything on the server, there will be a discrepancy between what the player sees on their screen and how the server sees the game due to latency ("ping"). The game will inevitably feel more laggy to the player

Philipp
  • 119,250
  • 27
  • 256
  • 336
  • problem with not sending position info of enemies behind walls is that the server needs to do a LoS computation for each client (and for the path everyone is taking) this becomes very expensive quickly, dividing your map into zones and only send the data in the immediate surrounding zones is much easier – ratchet freak May 03 '13 at 08:04
  • @ratchetfreak There are many techniques to optimize such LoS calculations. When you use binary space partition and portals, you can already rule out most trivial cases of obstructed sightlines. – Philipp May 03 '13 at 08:25
  • The latency (ping) must be all even to prevent lag so that the players will not think or accused them as hackers. Unfortunately, all victims have been kicked everyday considering them as cheaters even though they're not using hack tools. Sadly but true.

    Also, @Philipp, you're saying that less info on the MMO program project will be less chance to let hackers to cheat for the win, aren't you?

    Most of all, most users never stop complaining because of hackers still alive even after server maintenance. Or maybe, is it some of the company's server having hard time to get rid of the hacks?

     – David Dimalanta May 03 '13 at 09:13
  • @DavidDimalanta Indeed. A cheat can only expose and manipulate the information which is available on the client computer. So the best way to prevent cheating is to not give the client any information which must not be exposed to the player and to not store any information on the client when manipulating it could give the player an advantage. When you design a network protocol, never assume that the client does only what it's supposed to be doing. – Philipp May 03 '13 at 09:19
  • It's like keeping a secret especially on promoting new powerful weapons in the next update for example. – David Dimalanta May 03 '13 at 09:34