Beth Domon - Twitch Partner

Email: [email protected] Avid reader. Cancer Survivor. I play video games on Twitch. WoT Fangirl.

[RivalsInfo @RivalsInfo]

Hello Everyone,

In a previous life, I used to do offensive and defensive anti-cheat research professionally, and one thing I’d like to say is that this game is doing the absolute bare minimum to secure and protect itself against cheaters. To give the team some credit, combating cheating is extremely difficult because cheat developers are constantly adapting (especially with AI) and testing new methods faster than most of these developers can realistically respond to. I’m going to outline what the anti-cheat team does right and what they do wrong, and then let you come to your own conclusions about the overall state of the game’s anti-cheat efforts.

Vocabulary:

- DLL: This term will be used heavily, and it refers to a piece of software that is injected into a process (for ex. Marvel Rivals) and is capable of executing arbitrary code within the game process. This allows cheaters to modify or manipulate different parts of the game in order to gain an unfair advantage (f.ex reading from or writing to the game state).

- DLL Sideloading // hijacking: Replacing a legitimate DLL that the game uses with a malicious DLL that allows an actor to execute arbitrary code within the game process while masquerading as the legitimate DLL.

- XIM: A cheating device primarily used on consoles to for example mask a keyboard and mouse as a controller allowing malicious actors to essentially have aim-assist, and run a ton of other scripts that give malicious actors to gain a competitive edge over players

- Function Hooking: This allows a malicious user to redirect how the code normally works, giving them control over how the program behaves and letting them change the result of certain functions.

What they do right:

- Sending telemetry from the game process to the anti-cheat backend server, even without the kernel anti-cheat running, to determine whether a game session appears legitimate or illegitimate (cheating).

What they do wrong:

- The Kernel Anti-Cheat component is pretty useless. It’s really only meant to serve a few purposes (it does a bit more, but these are the main components you should actually care about), and the entire system becomes redundant when you can simply disable the kernel component. The first purpose is acting as a preventative measure against DLL injection, which it does a poor job at because you can use DLL Sideloading and the game will blindly accept illegitimate DLLs and inject them into the game process. Another purpose is sending telemetry to the anti-cheat backend, which collects data about the process and scans for cheat signatures, abnormal process conditions, and unauthorized modifications. The Kernel Anti-Cheat probably does more than that, but it becomes pretty useless when you can just disable the kernel anti-cheat component entirely.

- There have been claims that if you run a certain command line argument it completely disables the anti-cheat, but this is only partially false. It disables the kernel anti-cheat component, but it does not disable the anti-cheat that lives inside the game process, “QSec.” QSec is another anti-cheat component inside the game process, and it does a bit of the heavy lifting by sending increased telemetry about your aim score, XIM score, and other unusual process events. This can also be disabled by patching the game executable on disk, preventing the system from even being initialized. (I’ve sent this directly to the developers a while ago, and they’ve done nothing with it.) One thing I will give them credit for is that they’ve at least attempted to protect this code, but they’ve done a terrible job executing it. There’s also another component they use called “AC (Anti-Cheat) SDK.” This component exists in an extremely niche location within the game process, but I won’t explain it further because it could lead to additional attack vectors, although the team already knows where it lives. From what I understand, this component also sends additional telemetry and periodically sends screenshots of your game to the anti-cheat backend (at least for high-risk players) in an attempt to detect cheats like ESP, which gives exact player locations through walls. This component can also be disabled.

- The anti-cheat team also has an additional QSEC (anti-cheat) component that is completely server-side. This anti-cheat automatically scans replay files and match data to determine whether a player is cheating based on heuristics. This approach is extremely flawed because a cheater can disable the components I explained above and “humanize” their cheats to avoid detection. It can also lead to false bans if the system’s assumptions are incorrect, which appears to happen periodically.

- The Anti-Cheat team actually does nothing to validate whether the kernel component is running or not, this is one thing some anti-cheats like "Easy Anti Cheat" does right, the game server will kick you out if it doesn't receive a valid token from the client generated by the anti-cheat. Sure some telemetry may give the team some insight saying "Hey so this user isn't running our anti-cheat, they're probs sus asf", but when those telemetry components are disabled and your only component is the server sided anti-cheat it makes the entire system super redundant.

- The Marvel Rivals team claims that a user who gets banned will get device bans, and IP bans. From my understanding they don't IP ban, but they do attempt to device ban (HWID Ban) and they do a terrible job at it, since you can disable the kernel component of the anti-cheat the game process is left with only one way.. do call windows functionality to generate a Hardware Identifier based on the limited functionality that Microsoft gives them. This is completely redundant when you can disable all of the components I've mentioned earlier and the use Function Hooking to essentially "spoof" your hardware identifier, and once you get banned, you can clean all of the traces the game process leaves and create a brand new account as if nothing happened.

There's a few more components that I haven't talked about or may not completely know about, but I hope this gives you a slight idea on how the team actually handles cheating. I've actually sent most of what is currently in this post directly to the team months ago, and they haven't done anything with it. You know where to contact me NetEase. Chào👋

[Jake Justice @jakecobb]

They want you to forget. They don’t want you to see this.

Keep sharing this so we can’t forget what they did to us that day.

[Captain Mark Kelly @CaptMarkKelly]

As gas continues to rise, Trump is awarding himself a $1.8 billion slush fund for his loyalists — all while slashing your healthcare to cut taxes for the super wealthy. Arizonans are filling up their tanks wondering who Washington is actually working for.

[Beth Domon - Twitch Partner @BethDomon]

@Beaulooo This sounds pretty interesting! I played Apex for about six months when it first came out and tried it again a couple of years ago, but it had changed so much I couldn't get back into it. I'm a Twitch Partner and currently play Marvel Rivals primarily. I'd love to be considered.

[Mary Peltola @MaryPeltola]

Deliver, or go home.

[Sen. Bernie Sanders @SenSanders]

If you give a politician $5 to influence a vote, it’s bribery.

If billionaires spend $50 million to influence an election, it’s legal.

That is what a corrupt campaign finance system looks like.

[Captain Mark Kelly @CaptMarkKelly]

Trump never has money for healthcare or VA staff or anything to actually make Americans’ lives better — but somehow found $1.8 billion to reward his allies with your tax dollars. That's corruption, plain and simple.

[Team Talarico @TeamTalaricoHQ]

.@JamesTalarico: Social media algorithms and cable news networks tear us apart so we don’t notice they are closing our schools, gutting our health care, and cutting taxes for the rich. They want to keep us from seeing that there is far more that unites us than divides us

[Randy Pitchford @DuvalMagic]

Fun facts: Customer Service reports for Borderlands 4 at roughly 1% or so of installs.

Using that simple, rounded ratio…

More than half of the tickets (~0.55% of customers) are users reporting difficulty with their SHiFT accounts (lost e-mails/access, etc).

The next highest ticket is about FoV controls on console (working on it).

Next, 0.055% of customers are reporting issues with Twitch drops.

And, 0.04% of customers are PC performance related, with CS flagging 0.009% as “valid”. 0.037% have experienced success with education (settings coaching).

That is less than one percent of one percent (0.01%) of customers using CS tickets for valid performance issues, which is less than 1/5 of the users using CS to get help with Twitch drops.

This reality is dramatically different than what you would expect if your only sources of information were, say, certain internet threads.

Here’s the most important truth: We exist to entertain you. We want *every* customer to have the best possible experience. We are not stopping - working day and night to not just add more and more awesome stuff to the game that critics and fans seem to be in nearly unanimous agreement have made Borderlands 4 the best game in the series, but also to continue to improve the technical aspects of the software, especially for the wide range of configurations on PC’s.

As we go, know that CS is there to help.

Know that for the vast majority of people reporting issues, CS has been able to help!

Everyone who has real issues is someone we care about - we want to help everyone because we want everyone to enjoy the game!

I thought these stats would be interesting to some of you and be useful perspective if you are getting your feelings from others on-line.

[First To Hear It @firsttohearit]

James Talarico just flipped the script on MAGA attacks against him.

This is how you do it.

[James Talarico @jamestalarico]

I’m tired of being pitted against my neighbor. 

I’m tired of being told to hate my neighbor.

People across the political spectrum are hungry for a new kind of politics.

[Auro Zoro 💜➕ @AuroZoro]

My server got hate raided tonight by a person running an app that spams hateful messages. We banned the person and disabled applications. I ask everyone to do the same to prevent this from happening to you.

Why does Discord have an app that does hate raids? I'm truly disgusted.

[SteffyEvans @SteffyEvans]

I want to clarify something, because I know some people may have doubted my viewpoints. I absolutely hated Charlie Kirk and the hateful things he was saying. I never stood with him or his ideologies. My platform has always been about standing against hatred. But as a human being, I don’t enjoy the idea that a live execution is the right way to respond.

We’ve grown so desensitized to violence that it almost feels normal. School shootings are “normal”, people are murdered in public is “normal”, and now executions are being celebrated online. The world has become disgusting, and it terrifies me how easily death is cheered on. I’m terrified to attend any big event nowadays in the US, I’m terrified to have children myself to attend public school. I’m terrified, and you should be too.

Instead, we should be standing up, speaking out, and challenging harmful ideologies. Without causing harm ourselves. No matter how strongly we disagree, death should never be the answer, and celebrating it shouldn’t be either. Am I really so wrong for believing that?

If you feel the need to attack me for this, don’t waste your time. Educate me instead.

[Beth Domon - Twitch Partner @BethDomon]

@biggysweats @Borderlands @2K I played last night through early access and had a REALLY good time! Which character are you going to try out first? I went with Vex because I just love Sirens

[Gene Trevino @GenoVeno73]

FUCK YES!!!

One death is too many.

WAIT FOR IT — Jon Stewart names off numerous school shootings that the right wing MAGA cultists don't seem to be bothered with.

But they sure love blaming Democrats — even when the shooter hasn't been identified nor apprehended.

👇👇👇👇

[Anson Mount 🖖 @ansonmount]

2) A 31 year old father of two is dead for the heinous crime of speaking his mind. I didn’t find Kirk’s work to be in any way helpful, but NO exchange of thought excuses assassination, nor the enjoyment of it. Such childishness should have no place in the United States. Peace.

[Anson Mount 🖖 @ansonmount]

1) The righteous tone I’m seeing from people on the left who are relishing their opportunity to dance on a corpse is utterly horrifying. Let me be clear: I agree with pretty much nothing that Charlie Kirk stood for. But certain, so called “progressives” should check themselves…

[Beth Domon - Twitch Partner @BethDomon]

@LiberalDreams46 @PrezLives2022 The fact that you’re saying there is NOTHING Republicans can do to ever “change your minds” again shows who the weak-minded one among us is.

[Beth Domon - Twitch Partner @BethDomon]

@SteffyEvans Preach, Steffy!

[Beth Domon - Twitch Partner @BethDomon]

@LiberalDreams46 @PrezLives2022 Categorically false. I was conservative. I’ve voted for multiple Republicans at the local, state, and national level. Now a proud blue dot in a red state. Your statement just confirms the absolutism that is the fatal flaw of extremists on both sides.