Hey all,
I’m looking into an anti-cheat system for my small community. One concern I have, is remote code execution. Is it one of those things where you put faith into the developers of the AC that the code is clean?
Are there any ACs that do not use remote LUA execution, or at the very least are reputable enough to look at?
90%+ of them seem to be shady and ran by questionable people, and somehow the most popular ones are involved in abuse of vulnerabilities in the platform itself (rather than reporting them), outright hostile behavior towards us and otherwise being just as bad as the ‘cheaters’ they purport to fight against.
In general, I’d rather wonder why you need an ‘anti-cheat system’ in the first place: is there any specific things you’re having to mitigate, are you just hearing talk about such existing and trying to solve things by means of prophylaxis, or… what is causing this common use case? We’re actually somewhat curious about this ecosystem and what leads to it so we can actually improve the platform itself in this regard.
The question should not be why an anticheat is needed. I work for a small to midsized server and we have approximatly 5-10 bans from our Anticheat every week. If a troll streamer comes around with his community this can go up to 20-30 bans a day …
Since every ban gets a screenshot from the client, containing the evidence and aswell a description what happened, we can say that around 70-95% of the bans are legit.
Mostly people get banned for spawning blocked weapons on our server or causing mass explosions by spawning vehicles, but we catch aswell players that try to open their modmenu or cheat money / other items. this can mostly be tracked in our inventory / banking logs aswell.
Nevertheless we are nearly shure we catch not anyone, because for a few cheats the detection system finds the most common keys used to open the menu of the cheat and flags / screenshots / kicks the possible cheater … we decide based of the screenshot if a ban should manually be done in these cases.
Logicwise the anticheat systems need to work nearly the same as a cheat to function and work as they should be, therefore they need to use an amount of these functions aswell.
As most of the AC Systems are payed and encoded, i would assume THIS is the case these guys do not want to work with you / the community to solve the issue, as solving the issue platform wise would simply remove their income.
The reason I’m looking into anti-cheats is for a mechanism that prevents the use of LUA executors. I can scramble events to prevent common events from being used with injectors and such, it’s more to prevent the tool usage to begin with. There are a fair few paid injectors that still allow people in and while the Cfx.re ban system is good, there are ways to defeat it.
The best method to prevent problems with events is simply to do exhaustive server-side checks, leaving nothing to chance, even a simple check of where the player is or a timeout between calls to the event can help. Remember that it is always the server has to decide whether to give an item etc.
The only thing that in my opinion makes sense for an anticheat is what already fivem server-side offers, which is the ability to block the propagation of spawned entities with mod menus or blacklisted vehicles/weapons.
If something is written in an unsafe way anticheat can’t do too much.
This is my opinion, do not take what i wrote as absolutely true, i also continue to learn (even though i have been part of this community for long), so if you have any constructive contrary opinions please write them
There is nothing that an ‘anti-cheat script’ can do that will ‘prevent the use of Lua executors’, only flag some of the effects of such, many of which are easy to handle in your gameplay code yourself, or otherwise by configuring some mitigation variables on your server.
Similarly, if your gameplay code is designed properly, this should not be an issue either, and preemptively coming up with weird measures is just not helpful at all.
The post above - Anti-Cheats and Remote LUA Execution - #5 by XenoS.exe - does raise a few sensible points here.
Also, most of the points posed by @WoFNuLL above don’t really make sense nor add up, and it’s this ‘but they obviously are needed, and of course they don’t want to work with you, duh’ attitude that only amplifies the issues these scripts cause.
One thing I’m however going to respond to:
That’s not the case at all. For one, I’m referring to the abusive behavior perpretrated by anticheat developers, including taking bribes from cheat sellers or abusing client-side vulnerabilities. Secondly, no, they would not ‘need to work nearly the same as a cheat’, since a cheat is injected client-side, and these scripts are… normal server scripts. None of that story adds up at all.
A similar argument would be ‘But the police arrests thousands of criminals every year, that means all police behavior is justified, right?’ or ‘The police is useless so we just take justice into our own hands!’, which is flawed in and of itself and also precludes further discussion in regards to solving both the original issue and issues stemming from these ‘odd’ solutions.
I assume that you’re referring to e.g. configuring honeypot events that can trigger exports from a ban system built-in to txAdmin or EasyAdmin, that when the event is triggered it bans the player yes as well as things like scrambling events and such? They would be some of the simplest yet powerful mitigation strategies that I can think of, correct me if I’m wrong.
As XenoS.exe mentioned, things like checking locations and adding timeouts to events being triggered all does make logical sense. I imagine it all comes down to research, learning from others’ mistakes and working to improve them.
To combat this, does CitizenFX not have the capability to prevent these systems from being used?
That’s what I thought. What real benefits do Anti-Cheats offer that we can’t already use?
If you want to avoid remote code execution, the solution is to choose anti-cheats advertised on the CFX forum. These anti-cheats have been checked by moderators and use only the escrow system (+ no shady code), not obfuscators.
If you have to use anti-cheat resources to make sure people don’t exploit or to protect yourself from remote code execution, you should reconsider whether you should be running a FiveM community. The best way to protect yourself is to know your code, and these anti-cheat “developers” take advantage of the fact that people dont know what theyre doing half the time.
Perhaps you didn’t understand what I meant. The anticheats advertised on the CFX forum have been reviewed(the code) by moderators. Why do you think the well-known shady anticheats aren’t advertised there? It’s likely because 99% of them are collecting information and taking control over your server in ways they shouldn’t.
I agree with you that creating your own anticheat is the best approach! However, I doubt that someone building a FiveM server has the time to keep up with detecting all the new and old cheats or abuses.
Just because something is posted on the forums doesn’t mean that the code is reviewed by moderators.
There is no way to do that at the scale that Cfx operates at.