Valve
is beloved by the PC gaming community.
It was already a fan favorite for games like Half-Life but when they
created the Steam platform changed the way people play PC games online. Gabe Newell, one of the company’s
co-founders is revered across the internet.
So when a user on Reddit claimed that Valve’s anti-hacking software VAC
was reading every domain you visited and sending that information back to Valve. It’s a very serious claim, serious enough
that Gabe Newell posted a reply on Reddit. It’s long, but it’s a very good read.
Trust
is a critical part of a multiplayer game community - trust in the developer,
trust in the system, and trust in the other players. Cheats are a negative sum
game, where a minority benefits less than the majority is harmed.
There
are a bunch of different ways to attack a trust-based system including writing
a bunch of code (hacks), or through social engineering (for example convincing
people that the system isn't as trustworthy as they thought it was).
For
a game like Counter-Strike, there will be thousands of cheats created, several
hundred of which will be actively in use at any given time. There will be
around ten to twenty groups trying to make money selling cheats.
We
don't usually talk about VAC (our counter-hacking hacks), because it creates
more opportunities for cheaters to attack the system (through writing code or
social engineering).
This
time is going to be an exception.
There
are a number of kernel-level paid cheats that relate to this Reddit thread. Cheat developers have a problem in getting cheaters to
actually pay them for all the obvious reasons, so they start creating DRM and
anti-cheat code for their cheats. These cheats phone home to a DRM server that
confirms that a cheater has actually paid to use the cheat.
VAC
checked for the presence of these cheats. If they were detected VAC then
checked to see which cheat DRM server was being contacted. This second check
was done by looking for a partial match to those (non-web) cheat DRM servers in
the DNS cache. If found, then hashes of the matching DNS entries were sent to
the VAC servers. The match was double checked on our servers and then that
client was marked for a future ban. Less than a tenth of one percent of clients
triggered the second check. 570 cheaters are being banned as a result.
Cheat
versus trust is an ongoing cat-and-mouse game. New cheats are created all the
time, detected, banned, and tweaked. This specific VAC test for this specific
round of cheats was effective for 13 days, which is fairly typical. It is now
no longer active as the cheat providers have worked around it by manipulating
the DNS cache of their customers' client machines.
Kernel-level
cheats are expensive to create, and they are expensive to detect. Our goal is
to make them more expensive for cheaters and cheat creators than the economic
benefits they can reasonably expect to gain.
There
is also a social engineering side to cheating, which is to attack people's
trust in the system. If "Valve is evil - look they are tracking all of the
websites you visit" is an idea that gets traction, then that is to the
benefit of cheaters and cheat creators. VAC is inherently a scary looking piece
of software, because it is trying to be obscure, it is going after code that is
trying to attack it, and it is sneaky. For most cheat developers, social
engineering might be a cheaper way to attack the system than continuing the
code arms race, which means that there will be more Reddit posts trying to cast
VAC in a sinister light.
Our
response is to make it clear what we were actually doing and why with enough
transparency that people can make their own judgements as to whether or not we
are trustworthy.
Q&A
1)
Do we send your browsing history to Valve? No.
2)
Do we care what porn sites you visit? Oh, dear god, no. My brain just melted.
3)
Is Valve using its market success to go evil? I don't think so, but you have to
make the call if we are trustworthy. We try really hard to earn and keep your
trust.