Hack-Fu = Ban-U

[Shockeye]

We wanted to take this time to make an announcement about a serious hacking violation in World of Warcraft, one for which we have zero tolerance. Certain individuals have been identified as using speed hacks to accelerate their characters. This goes against the theme of fair play that we have instituted for the game, and is in clear violation of the World of Warcraft Terms of Use.

Those individuals who were caught using the speed hack have been banned from the game and have had their accounts closed. We must stress once again that we are opposed to hacking and cheating of any kind and are dedicated to maintaining a fair environment in our games. This will serve as a final warning to others who are considering using the speed hack. If you are caught using it, you will be banned without question from World of Warcraft and your account will be revoked.

Thank you for your understanding and cooperation in this matter. If you suspect someone of using the speed hack, or wish to report other instances of cheating, please email us at hacks@blizzard.com. Thank you again for your continued support.

Speed hacking is bad for you.

Now what to do about those fishbots?

[schild]

They need to learn how to FIX THINGS.

[Trippy]

I'm glad they are taking a hard line against these sorts of things. It's a welcome change from their B.Net policies. However, not being a PvPer I'm not really concerned about people speed hacking -- I'm much more worried about the reports coming in about item/coin dupping. I've experience the situation myself where I've camped out and when I've come back in I'm not in the same state as when I camped out so it's pretty clear they have a database/world state synchronization problem. I hope they get that fixed soon.

[Margalis]

I've never understood how speed hacks are possible. Doesn't the client tell the server where it want to go and the server actually tells it where it went? How is it possible for the client to effect movement speed?

Obviously I'm missing something since tons of games have speed hacks, but I don't understand how that could be.

[Murgos]

There has to be alot of interpolation with movement in these games.  When you turn, for example, waiting even 1/2 second or more for the avatar to turn after you hit the key would be unacceptible.   But even on a good day with optimal conditions you cant really expect better than 2/10ths of a second for round trip time frim client to server and back again.   So there has to be continuous minor updates from the server to the client and from the client to the server.  

The client does something and thells the server "Hey, I'm here and over the next few moments I'm going to probably be over there".  The server say ok go for it.  And the client sends back, "No wait change of plans, I'm actually here I was mistaken and  I'll be going there."  Do that enough times and you can generally find the crack that lets you get optimal change in position that seems sane enough taken bit by bit but put together as a whole is just all out of whack.

There has to be some trust in the client for these things to work at all, no one would play a game where there was a noticable pause for EVERY action as the server sanity checks everything.  Alternatively, running everything on the server and having the client just be a dumb terminal would mean you would need a server for every few dozen players.  WAAAAY too cost prohibitive.

[sinij]

There is just no excuse to release multiplayer game that can be affected by speed hack. That and speed-hack like behavior can happen with shitty connections so I wouldn't be surprised if few innocent dial-uppers get banned.

[Soukyan]

I've never understood how speed hacks are possible. Doesn't the client tell the server where it want to go and the server actually tells it where it went? How is it possible for the client to effect movement speed?

Obviously I'm missing something since tons of games have speed hacks, but I don't understand how that could be.

There's a buffer zone that's calculated for where your character should be when the server is communicating with the client. As long as you are within the acceptable range, then the server accepts where you are and does not correct your position. Think of it as a circle around your character where your character is the center point. The radius of that circle is determined by subtracting the slowest run speed (standing still) from the fastest run speed (buffs, maybe mounts, whatever). The server has your starting position. You start moving in any direction. Every so often (let's say 5 seconds), the server checks your position with the client and determines if you fall within the acceptable range (within the circle from your starting position) and if so, updates itself with your position and a new acceptable range of movement.  If you are not in the acceptable range, it corrects that by moving you back to where you should be based on calculations. That example may not be exactly how Blizzard does it, but it's just for better illustration.

Now, when I was testing the game for hacks back in beta, it did not appear that the server cared where you were. It seemed that you could move at the maximum speed that the engine supported and the server would simply accept the client updates as to your character location. Now, they may have done this to prevent issues like rubberbanding when there's high latency between client/server. I don't know. I do know that tinkering with the console commands with the alpha client allowed you to adjust your speed upward to a very fast pace. It could be that the max run speed in the game is just insanely high for some reason or other.

Anyhow, it's good to see that they are doing something about it. I will bitch and say the same thing about Blizzard that I said about Mythic (who still have also not fixed the run speed hack in their game). Hardcode the prevention instead of trying to catch every offender. You'll never be able to accurately do so and having the community police itself is a bad idea when you're dealing with a lot of juveniles. False claims of cheating, etc. all waste the time of your game administrators. I used to administrate MUDs and one thing I always did was use cheaters to find bugs/cheats/problems so I could fix them and then permban the offender afterwards. I hard coded the fixes. I never relied on a "rule" or "policy" to enforce. That's time consuming and inefficient.

[Jayce]

It seems everyone has their pet theories as to why they work, but either a) being an MMOG developer creates a stupid field around you and you somehow forget how to fix things, or b) the problem is HARD.  I'm personally going for b.  AC1 never did fix their problem, they were only able to put in detection and banzor.

The fact that we still are facing these problems 5 years later tells me it's not trivial.

[sinij]

Problem is hard, but it was solved multiple times so you don't need to do it from scratch. Speed hack makes it so timing done on client side cannot be trusted - with speed hack you can send packages and updates of your position/actions faster than expected and unless server checks how fast you can send updates you get more updates than someone not running speed hack. Hard part is that connection lag can delay some packages resulting in server reciving number of them at the same time. So to fix speed hack you need to determine what is acceptable level of 'bursts' client allowed to have before you decide client is compromised.

[Alkiera]

Sinij describes one type... another type of speed hack works on the fact that some 3d engines base run speed and other similar things on the framerate, so they run a benchmark, then set up the framebuffer update loop with a timing loop to get to the 'ideal' framerate, from which things like run speed and animation play speed are calculated.

So if you 'fool' the benchmark into grading your computer as worse than it is, then you get a shorter timing loop, a higher framerate, and higher runspeed.  EQLive works like that.

Alkiera

[Shockeye]

Bot-Using Accounts Banned - Indoflaven on 12/7/04

We have recently verified that certain individuals were using third party "bot" programs to automate their characters in World of Warcraft. A bot is used to play an account non-stop, allowing its user to accumulate money, items, and experience without actually requiring the user to be physically present to play the game. The use of bots is a violation of the World of Warcraft Terms of Use and is absolutely prohibited. Therefore, the accounts identified as having used bots have been banned.

Blizzard Entertainment is committed to maintaining an environment of fair play in World of Warcraft. As stated previously, the company has a zero-tolerance policy for cheating or hacking of any kind. Players caught using a bot program to automate any of their characters' actions will have their characters removed and their account banned. They will not receive a warning. Over 300 accounts have already been banned for offenses of this nature.

Thank you for your understanding and cooperation in this matter. If you suspect someone of using a bot, or wish to report other instances of cheating, please email us at hacks@blizzard.com or submit a GM ticket in-game. Thank you again for your continued support.

[Koyasha]

EQLive also believes the client whenever it says where the character is (or it did, I don't know if they have changed that).  Makes it possible to hack the client to tell the server "I am here" when here is across the zone from my current location.  But, from what I understand, the server also checks your movement speed and such, so that it logs whenever you travel too far, too fast.  Speed hacks work in EQ, but they're also very easy to catch.

This is what makes *moving* in EQ completely lag-free.  When lag hita, it's generally the mobs that are playing catch-up when server and client resync, because client has moved to X location and mobs thought it was at Y location, and they need to get to X location now.  In my opinion, this is the best way to do things, and work on making a foolproof method of *catching* people, because trying to prevent speedhacks as far as I know can only be done by taking that trust away from the client, which will always result in some amount of rubberbanding or other 'you thought you were here but you're actually over there, HA HA' by the server.

P.S.  My understanding may be flawed or out of date, but I'm reasonably sure this is how it was at least at one point.

[personman]

Bot-Using Accounts Banned - Indoflaven on 12/7/04

They must have pretty good data mining to qualify the subs needing CSR monitoring - either that or it's a pre-emptive announcement.

I like the fishing mini-game but it wouldn't bother me to see it removed.  Anytime the sole obstacle to a desirable goal is just time you'll see macroing.