Breaking good - from cheat developer to AAA cheat analyst
Updated: Sep 8
In a blog from earlier this year, we presented research we did to estimate how big the cheat industry really is. The answer was big - our median estimate for the slice we looked at was an annual turnover of $8.5 billion, with an upper estimate of $13.5 billion.
As we’ve highlighted elsewhere, that makes cheating bigger than the gaming markets in every country except the US, China and Japan. But despite being such a large industry, and being as old as online gaming itself, it remains cloaked in secrecy.
Whilst we commonly hear from players encountering cheating in their favorite games, and we’re beginning to hear more from the publishers as they become more open about the steps they’re taking against cheaters, we rarely hear from inside the cheat communities themselves, particularly the developers who sit at the heart of them.
Unsurprisingly they are reluctant to come into the open and discuss what they do. Instead, they hide behind their brand names and fake ID’s, only communicating through increasingly exclusive private communities, deploying on-point OpSec practices to avoid identification and possible litigation.
Fortunately, there are cheat developers who decide to turn their backs on the cheat industry and put their talent to better use; working for rather than against the game publishers, who are increasingly recruiting them for their security teams. After all, who better to outfox the cheat developers? If anyone knows how to protect a game it’s the people who understand how cheat developers operate, and the weaknesses they look for in a game’s security. It's the epitome of poacher turned gamekeeper.
Generally speaking, those that make this move continue to keep a low profile - after all it’s not without its risks. However, we were recently lucky enough to persuade Hank (not their real name), an ex-cheat developer working at one AAA publisher we work with, to talk to us about their journey, the decisions they've taken along the way, their advice for anyone else thinking about making the same move, and much, much more:
What initially drew you into cheat development? When did you start?
Back when I was 11 or so, I started playing 'XXX' and 'XXX', both of which at that point had very little anti-cheat, which interested me, as I had already been curious about computer security. There were a few games around back then that made me look into tools like Cheat Engine, but I was just a script-kiddie at that stage (aka “skid”), with little understanding of why things worked. A good example of one of my first times bypassing some form of anti-cheat or anti-tamper was on an indie game, which had public information around using Cheat Engine to search memory for your points and modify them, but the score was obfuscated as string text instead of numbers, so 833 would be represented as an obfuscated string “hxx”. At that time, I didn’t really understand it but that was most likely the first time I actively took action to bypass some form of anti-cheat, even though it was just a small game that I was interested in.
From there, I skipped around infosec fields a bit for a few years but got back into cheat development on a popular game, by modifying and fixing public sources on sites like UnknownCheats, another big “skid” move, but it seriously helped my understanding of how memory works and how games can be modified to cheat.
After gaining understanding for the basics behind cheat development, I moved onto another popular game, which at the time was using a kernel anti-cheat solution that was still maturing their approach to anti-cheat and game security as a whole. This forced me to learn basics about bypassing kernel anti-cheats and reverse engineering with tools like IDA Pro or Binary Ninja, which kickstarted my obsession with the x86 assembly language, low level programming and eventually my career in reverse engineering.
What are the biggest misconceptions that publishers have about how cheat developers operate and think?
One of the bigger misconceptions studios have around cheat developers in general is that every cheat developer is motivated by profit entirely. Where there may be whole businesses that organize around profit as their main source of motivation, many cheat developers and prior to joining XXX, I’d include myself in this group, do it for the ‘love of the game’.
As a hobbyist reverse engineer entirely interested in the challenge or fun behind it, I found developing exploits and researching attacks would scratch that itch even though the result still negatively impacts the game. For quite a few individuals, writing exploits or understanding the engine is a fun puzzle to solve rather than a source of a business, even if cheat development and selling cheats can lead to money.
This often leads to a lot of focus around big sellers, which can be good for anti-cheat but can miss quite a few of the developers we may or may not want to target, depending on your viewpoint and ideology. On a personal level, I don’t inherently object to reverse engineering a game, as I’ve loved the experiences that I’ve gained from doing what I’ve done, and could not be where I am without it, but obviously 'XXX’s and other companies terms of services have explicit mentions around reverse engineering not being allowed and that is a part of the conversation around anti-cheat.
Walk us through the typical workflow of developing a cheat. What's the process from identifying a vulnerability to creating a working exploit?
A lot of the workflow for exploit development really depends on the person. People take different paths, but I usually begin with understanding specific parts of a game that I find interesting and focus on that. You can guess all you want to attempt to get a vulnerability to show itself, but without a deeper understanding of the actual logic behind some system it can be difficult to identify viable attack surfaces. If you understand the logic you can start to break down where issues could live and specifically investigate those areas for attack vectors.
Normally once I find a target, I’ll spend some time and write down information I know about it to try to rubber-duck myself into thinking about possible exploits. Once you do this, you can walk through hypothetical system state changes and ask yourself, “What if X was Y and what would Z do if that was the case?” and if Z did what you were looking for, you have yourself an exploitable vulnerability.
How has the cheat development landscape evolved over your career? Are modern cheats more sophisticated?
I’d say it’s somewhat split, skill-wise or dedication-wise. You have quite a few cheat developers who are very sophisticated, (developing) DMA cheats for example, but you also have a lot of people just jumping into the market for money, at least that’s how I imagine it. Quite a few cheat developers pop up, or exist in general, that don’t develop new bypasses and would rather take on older examples from public sources or take ideas from them without changing the execution much. Typically, public sources or known bypasses are easier to detect by anti-cheat solutions, but it’s personally disappointing, as I love seeing cheat developer’s research be put into use and a bit of a challenge is always fun.
How has the business model changed? Has it become more professional?
Whether or not the business end of things has changed, I wouldn’t be able to say or ascertain as I’m not near it anymore. But I do know while I was around it, the cheat community ecosystem was largely informal and pretty ruthless.
Sometimes you’d have cheat developers contracted by sellers to develop things, but a lot of bad things would happen. People would get scammed, code would be stolen, trojans ran on computers and there’d be constant in-fighting and adversarial behavior within the community, as developers would mess with each other. If this has changed, I would not know, but I have my doubts on things getting more professional for such a gray-market.
How much does the community and culture around cheating influence the participants? Is it seen as cool? What role do social factors play?
I think deep down every cheater knows that cheating is neither ethical nor socially admirable, but for a lot of them it’s just normal. You’ll notice once someone cheats on a game, they’ll usually keep doing it across multiple games, and even if a community or friend group knows someone got banned for cheating, they’ll heavily deny it, even if they genuinely were cheating. Admitting they cheated would mean a blow to their self-image that I think a lot of them avoid as much as possible.
What ethical lines existed in the cheat development community, if any? Were there certain types of cheats or approaches that were considered "too far" even among cheat creators?
In my side or groups, not many ethical lines existed. We’d cheat in games we’d play and use wallhacks, aim hacks, or cheats that exploit game functionality (speedhacks, etc.). I’ve personally witnessed a variety of unethical actions that cheat developers have done to one another. For example, I have seen hackers steal code from each other, or methods, or leak things. In practice, there were very few, if any, boundaries that consistently held within the community.
What was the moment or realization that made you want to transition to the other side?
I started taking my personal career more seriously once I turned 18. I started looking into other roles around that time, got my OSCP (Offensive Security Certified Professional certification) and started looking into general hacking rather than game cheating, which led me down my current path. I had no idea there was a formal defensive side to this space, and honestly for a while there probably wasn’t. Game companies started taking cheating more seriously than just using an anti-cheat from a provider and hiring for roles specific to anti-cheat fairly recently.
How did the move come about? How did you end up working at a AAA
publisher? Who approached who?
I was going to join the US Navy and be a CTN (Cryptologic Technician Networks) which is now CWT (Cyber Warfare Technician), and while I was planning on doing so, I got contacted on LinkedIn by a recruiter for 'XXX'. I was fortunate to come across this because I didn’t know these types of roles existed, but being in the industry now it’s only going to grow. Game teams and companies are realizing anti-cheat is a necessity for good public perception so demand for these roles will continue to grow going forward.
What does your experience as a cheat dev bring to the team?
A lot of my team’s effectiveness comes from the hacker mindset, which cheat development and my other experiences grew a lot. Without it, the ability of our team would be significantly reduced as that experience itself brings a lot of good for our roles. Most of the team are ex-cheat devs, so it’s almost a requirement since a lot of our responsibility comes from being able to develop and think like a cheat developer.
Knowing what you know now, what advice would you give to someone who wants to test their hacking skills by developing cheats?
I would go for it, with the caveat that how you follow through with it matters. Instead of practicing on multiplayer games where you can ruin things for other players, I’d say you should learn the aspects of it in a good environment, try to mod single player games you find fun or find a different avenue to learn these skills. Game hacking is a great subset of skills to have in this environment, and you can’t really get it outside of hands-on experience so I can’t say anything other than do it, especially as that’s how I learned.
Focus yourself on learning applicable skills rather than copying from others, the less time you spend being a skid the more worth you have in a field like this, and the more ability you have on your own. Research as much as you can into the things you enjoy, hack things, break them, fix them up in ways no one could imagine. That’s the best path forward if you’re interested in things like this.
As well as helping us understand what really motivates people to start creating cheats, we hope Hank’s story offers a counterpoint to the standard, binary narrative that cheat developers are simply malicious trolls who are solely interested in profit and ruining the game experience for other players.
Of course, there are some like this - those who’ll never show remorse and remain irredeemable. But one of the things this blog and interview demonstrate is that for many, reform is possible, and this can benefit both the individuals and the publishers in their efforts to manage cheating and can ultimately be a good thing for the industry.
We, for one, commend the publishers taking this approach to strengthening their game security and urge others to look at how they can do the same.
Comments