Exploitation (Warp, Botting, etc.)

There's been a lot of different kinds of exploitations that's been undermining the game as of late. These involve warping (from one node point to another, from one location to another, without the use of an Aetheryte Crystal), botting and other forms of exploitation. I've seen the warp exploitations myself, brazenly being used out where everyone should be able to see them, but either gets unreported due to apathy or that other players are also enaged in similar behavior.

If you want to know what is causing a lot of server instabilities, you might want to beef up your support staff that reviews the "cheating" tickets. Many players, myself included, have reported all sorts of things that are not limited to RMT spamming in chat. And I know some groups have even used these illicit programs for end game purposes.

I have to imagine this is of PC player base origin as this is a common problem in a lot of major MMO's and typically never accomplished by console players (I know a lot of console hackers and they've told me in the past that modifying the functions of an MMO is often too frustrating to complete). However the opposite is quite false when it comes to PC Players. I've seen individuals use add-on executable programs to modify how games operate.

We reall need to report these instances as a whole or they will probably go unnoticed. Lets make sure to step on This before it gets out of control.

Quote:

---

Originally Posted by Discordia

There's been a lot of different kinds of exploitations that's been undermining the game as of late. These involve warping (from one node point to another, from one location to another, without the use of an Aetheryte Crystal), botting and other forms of exploitation. I've seen the warp exploitations myself, brazenly being used out where everyone should be able to see them, but either gets unreported due to apathy or that other players are also enaged in similar behavior.

If you want to know what is causing a lot of server instabilities, you might want to beef up your support staff that reviews the "cheating" tickets. Many players, myself included, have reported all sorts of things that are not limited to RMT spamming in chat. And I know some groups have even used these illicit programs for end game purposes.

---

I have two videos of this going on that I included in reports. As for how SE can fix it, would likely invite using anti-debug/memory-encryption/anti-hooking techniques that tend to make the computer much more unstable. The types of innocent software caught in the crossfire of doing this (for example PSO2 immediately crashes all media players (Gameguard), Hackshield breaks whenever Windows Updates (Nexon software), Themida prevents attempting to run the game on WINE/Linux/MacOSX) when it starts wasting CPU cycles doing this. The anti-cheat software used by WoW treats running on Linux and programmable keyboards as cheating.

Like the one good thing that OnLive is supposed to solve is to nerf the ability for people to hack game binaries.

They don't need anticheat software. They need a special team of admins that are able to appear in any zone at anytime but be invisible in order to observe the reported characters. Very simple scenario: an admin receives a forward of a cheat report. Admin teleports to the exact XY coordinates of the player and observes them for some time. If the players performs an exploit while bein observed, the admin performs a ban/suspension process. I'm sure the admin could even have a window for monitoring chat box commands entered or even remotely monitor the .exe or config files to detect any abnormalities in CPU usage or unknown or anomalous code lines.

All they need to do is check the values the client is posted back are not too far out of the expected range, but no, instead the server just accepts any data sent from the client so you can jack your memory, say you're somewhere else, and the server just accepts it.

I think Ihm is right because that's what I have suspected. I know earlier on during Early Access (one of the very rare times I beat the log-in boss) that a character, level 1, was left outside innkeeper NPC in Uldah's Adventurer's Guild on Leviathan server, and you can see the lips moving, which means "chatting". Then all of a sudden it started to gurgitate stuff in /say, and they were all numbers, followed by what appeared to be codes or something similar. I think they had sat on some exploits found during beta and while other players had not stumbled across those to report to SE, proceeded to use these after release. SE needs to button up these exploitations because it *can* lead to server instabilities which may lead to more than just inconvenience (think about innocent players getting caught with corrupted data on their account)

Quote:

---

Originally Posted by xSinful_Snake

They don't need anticheat software. They need a special team of admins that are able to appear in any zone at anytime...

---

Have you played any other MMO? The number of staff employed full time is less then the number of people hacking the game full time. One game I had played, I know exactly how many GM's they have, and it's less than the number of servers.

We all keep thinking these are "easy to fix" by throwing staff at it, or off-the-shelf fixes, when it's not. If you want to beat the hackers, you have to beat them at their own game and actually leverage the community and GM's willingness to put an end to it. One game I played, the cheating was so rampant that they completely destroyed their European servers, because they relied too much on volunteers and had nobody capable of fixing the damage.

Here's what we can do in the mean time:
Take screenshots and video, use the game's "target signs" function to flag the bot, then right-click follow to show in the video that it's teleporting and the game can't follow. Show the video of them teleporting directly onto the gathering node and appearing in spots that are inaccessible. Right-click on the bot to show what level it's at and what gear it's wearing. Bots tend to wear all level 1 gear or no gear at all.
What SE can do break this:
- increase the rate of wear on gathering below-level tools and use this to check the bot reports with expected behavior. (eg attempting to mine level 10 with level 1 gear will break the gear after 10 attempts)
- check the positions of the gathering nodes against the positions actually "moved to", real players aren't able to move to two yalms in the air.

With FFXI they tended to wait and then banned thousands of accounts at time. Example of this:

http://www.playonline.com/ff11us/polnews/news9096.shtml

I was trying to find an example which including teleport hacks (I think they called it incorrect movements), but unfortunately I was unable to do so. I remember reading about it multiple times though so they're certainly aware it can happen and I wouldn't be surprised if they've been monitoring accounts doing that already.

I don't know for sure if they'll ban thousands at a time like the did in the past, just mentioning it as their previous history suggests they will.

why wait until they have thousands when it only take's 100 or so to f**k up the ecconomy

Quote:

---

Originally Posted by Syamic

why wait until they have thousands when it only take's 100 or so to f**k up the ecconomy

---

Probably because it's done as MDE (Mass Data Entry, or Massive Destruction of Evidence), usually it's a "bulk fix" instead of individual bans. Like banning 100's at once is because those 100's all matched the invalid data in their logs.

I know on my server (Diabolos) the number of bots just totally outweighs the ability to report them all. In just one smallish area, there was 30+ bots. Many were underground most the time just teleporting from node to node. I reported several, but after an hour of filling out cheat reports gave up. I don't want to spend my entire time online just trying to report these bots using the slow, cumbersome tools we have.
Just one GM in the area could have banned them all in less time than it took me to report those I did.

I'm curious about why MMOs don't use players anymore. It was a lot of fun being a Guide and although there was a little bit of exploitation, it wasn't bad. Nothing as bad as these hacks and exploits going on now. Of course, guides couldn't suspend/ban people - but we would go observe after receiving a report, and if it was true we could escalate it straight to a GM. Plus we could take care of all the standard issues that came in, like stuck players. It saved a lot of time for the GMs and all it cost the company was a few free subs. And doing player events was FUN!

Well, the bots successfully destroyed the shard market already.

By the way, for the teleportation cheat, I think it stems from the fact that, to avoid "rebounding", the position of a character is set client-side, thus making it easy to simply send a "fake" position to the server to teleport to. But yes, as someone mentionned, SE tends to make mass bans every so often rather than a few bans at a time, just like they mentionned they might ban or rollback any character that exploit the unmoving Chimera and Hydra bugs. Back in the FFXI days, they banned about a third of the endgame players for abusing a bug that duplicated gear that went unnoticed by SE for about a year. That was the Great Purges of Final Fantasy XI. SE will definitely ban abusers, but it can take some time.

The process to exploit the game, the memory and data being sent back to the server is not that difficult as it requires a creative method. Malwares and zero-day exploits are notorious for hijacking clients and the OS. The cheaters do the same. They use Windows zero-day exploits (think of Stuxnet) by injecting their own computer with these malwares that they engineered (or others have) and then "remote in" with another process on the same machine and manipulate the code/data. It's a lot easier than reverse-engineering the actual client as this gets around most client-side security and attacks the OS architecture itself. Part of the problem (or most) of game hacks, especially on the PC side, has to do with Windows shipping full of holes and legacy exploits from god knows when. This makes it so challenging for software developers to secure their products when the OS that it is being installed to is as insecure as leaving a door open in the middle of a crime infested neighborhood.

Quote:

---

Originally Posted by Discordia

The process to exploit the game, the memory and data being sent back to the server is not that difficult as it requires a creative method. Malwares and zero-day exploits are notorious for hijacking clients and the OS. The cheaters do the same. They use Windows zero-day exploits (think of Stuxnet) by injecting their own computer with these malwares that they engineered (or others have) and then "remote in" with another process on the same machine and manipulate the code/data. It's a lot easier than reverse-engineering the actual client as this gets around most client-side security and attacks the OS architecture itself. Part of the problem (or most) of game hacks, especially on the PC side, has to do with Windows shipping full of holes and legacy exploits from god knows when. This makes it so challenging for software developers to secure their products when the OS that it is being installed to is as insecure as leaving a door open in the middle of a crime infested neighborhood.

---

Quick fix: Only make a x64bit build that runs on Windows Vista or 7. Though in all seriousness, I think you're off the mark, nothing fancy is going on. The hackers are using off-the-shelf hooking software that I won't name, that creates it's own exe's and most of these EXE's are detected as malware by antivirus software:
Bkav HW32.Stranact.rqso
Comodo Worm.Win32.P2P-Worm.Palevo.fghk
TrendMicro-HouseCall TROJ_GEN.F47V0919
etc

I also wouldn't doubt the people running the bots get their accounts hacked as well.

Quote:

---

Originally Posted by worldofneil

With FFXI they tended to wait and then banned thousands of accounts at time. Example of this:

http://www.playonline.com/ff11us/polnews/news9096.shtml

---

Omg I remember when they banned tons of farmers. ore then one friend got banned cause they had a mule character to hold their excess stuff. I think they introduced more storage after that lol!

Its all Chinese Gil farmers.. thousands of them literally! These guys are making $10s of thousands per day right now. They are not going to slow down or do anything intelligent. Its China.. they will just flood the market daily with 100s of millions of gil each day until SE fixes it or everyone leaves the game. They are flooding the economy so bad right now, notice the inflation in game already... and the game just launched, if they do not fix this fast the game is going to take a seriously bad turn.

Yeah I just kinda need to be fixed SE, thanks mkay.

They should've seen this coming with the experience from FFXI and had easy tools to combat the situation from day 1, "MASS bans" few months from now will be like going to the toilet with the brown stuff already in your pants...

The damage is already done and it will take months upon months for the inflation to settle after the majority of these goons have been dealt with. To me this is totally negligent behavior from SE towards real customers to let shit slide as much as it has in the few weeks its been out.

This is beyond ridiculous now, there are too many mining bots to report them all! Are SE going to do anything about it?? I recorded a few of them if anyone at SE want to see what's happening with their own game!!!

This bot is hogging all the fleece:
http://www.youtube.com/watch?v=XZ0TdrOfdOY
(he has been doing this constantly for at least 48 hrs.. who knows how long!

Wall hacking, teleporting miner bot:
http://www.youtube.com/watch?v=hfD4xXC8zu8

There are too many to keep track of them all but maybe someone with authority should just go inside the game and start actually BANNING these people?

Quote:

---

Originally Posted by KisaiTenshi

I also wouldn't doubt the people running the bots get their accounts hacked as well.

---

Zero-day exploits are a dime a dozen, I just used Stuxnet as a very famous example, but you can get easy to do on your own (Adobe Flash zero day exploits are probably a better example and everyone and their grandmothers have been able to lift credentials from "drive by" visitors to their sites and inject tons of stuff through Flash Ads, etc)

I agree with your point about bots and hacked accounts, but I'm also convinced that many are victims of malware being planted through hacked websites. There has been several notable gaming sites which had compromised data and had their ad-model hijacked so that they'd deliver trojans unto unsuspecting users. It's becoming increasingly difficult to mitigate these threats and it just boils down to browsing habits and being aware of phishing attempts. What surprised me the most is that SE has yet to say, "Our support team will NEVER ask for your account information as we already have that." I don't know how many people were duped into clicking "support" emails in desperate attempts to fix whatever issues they may be having.

Actually there are ways of detecting that kind of "invisible" Admin/GM... they used to have a similar feature on bots used to play Silkroad Online (a very popular mmo played heavily in Europe, Asia & Middle Eastern countries). Regardless they need to find SOME way to block or stop these kind of abuses even if its invisible GMs. Anything at this point will be a step in the right direction.

i agree with needing some online admins i saw the same named bot/character go on for hours in gridania posting gil sales for real money got so annoying i could not even scroll up my log to read my /tells or my /fc free company chats

I'd like to add that it isn't possible for everyone to record video of this happening simply because people like the knowledge or the capability or eve simply play on console (you'd need a special device to record gameplay on console), so don't call my invisible admin idea a bad one just because you can do something I can't and I'm sure not going to use my phone to record my tv because that's just silly. They need more admins (active and quick-to-decide ones at that). Making it the players responsibility to PROVE what's going on with our own resources isn't the proper methodology of a reliable customer service model. We are caring enough to report the issue because we care for the community and the economy of the game, we shouldn't have to launch our own evidence collection case too.