Valve: No, Our Gaming Anti-Cheat System Isn't Tracking Your Voracious Porn Habits
from the honesty-is-the-best-policy dept
Valve Software this week found themselves at the center of an Internet hissy fit after reports emerged claiming that the company was using their Valve Anti-Cheat System (VAC) to monitor the browsing activity of the company's user base. A Reddit post specifically claimed that Valve's VAC was digging through your DNS cache entries and sending the lot of them back to Valve servers hashed with md5. The post quickly escalated, with Reddit users suddenly jumping to the conclusion that Valve was just as bad as EA, and the company was covertly trying to monetize user browsing data using DNS records.The entire kerfuffle forced Valve CEO Gabe Newell out of his fantastic nerd fortress to provide what was an interesting bit of insight posted to Reddit on how the normally very hush-hush system works. Newell noted that the company normally doesn't talk much about VAC because it simply provides cheaters with more ammo to hack the system, but he explained VAC wasn't perusing and storing DNS records wholesale, it was looking for very specific "calls home" made by cheat software:
"VAC checked for the presence of (kernel-level paid cheats). If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result."According to Newell, this particular effort lasted all of thirteen days before cheat developers found a way around it. The CEO proceeded to note that highlighting how sneaky VAC is in a somewhat sinister light is a form of "social engineering" that's cheaper than trying to develop better cheats:
"Kernel-level cheats are expensive to create, and they are expensive to detect. Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain. There is also a social engineering side to cheating, which is to attack people's trust in the system. If "Valve is evil - look they are tracking all of the websites you visit" is an idea that gets traction, then that is to the benefit of cheaters and cheat creators. VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky. For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light."The CEO insists that the Half-Life developer is entirely uninterested in tracking your interest in busty vixens. While the cat and mouse aspect of the story was pretty fascinating to watch, it's also a nice, all-too-rare example of how quickly issuing a clean, honest statement without assuming your customers are stupid can completely defuse a public-relations minefield.
Filed Under: anti-cheat, gabe newell, steam, vac, video games
Companies: valve