Zero is a customer service representative for one of the biggest video game cheat providers in the world. To him, at first, I was just another customer. He told me that the site earns approximately $1.25 million a year, which is how it can afford customer service representatives like him to answer questions over TeamSpeak. His estimate is based on the number of paying users online at any given time, the majority of whom, like me, paid for cheats for one game at $10.95 a month. Some pay more for a premium package with cheats for multiple games.
As long as there have been video games, there have been cheaters. For competitive games like Counter-Strike, battling cheaters is an eternal, Sisyphean task. In February, Reddit raised concerns about lines of code in Valve-Anti Cheat (VAC), used for Counter-Strike and dozens of other games on Steam, that looked into users DNS cache. In a statement, Gabe Newell admitted that Valve doesn't like talking about VAC because it creates more opportunities for cheaters to attack the system." But since online surveillance has been a damning issue lately, he made an exception.
Newell explained that there are paid cheat providers that confirm players paid for their product by requiring them to check in with a digital rights management (DRM) server, similar to the way Steam itself has to check in with a server at least once every two weeks. For a limited time, VAC was looking for a partial match to those (non-web) cheat DRM servers in users DNS cache.
I knew that cheats existed, but I was shocked that enough people paid for them to warrant DRM. I wanted to find out how the cheating business worked, so I became a cheater myself.
That s how I found Zero. After we finished talking, he reminded me to send him the $25 I promised him. I did not at any point say anything that could possibly even suggest that I would pay him for any reason. I asked him if he meant that was something I promised him or something that I should just do. Both, he said. I also advise you not to use this information against me. That wouldn't be wise.
How I became a cheating scumbag
Bohemia Interactive (Arma, DayZ) believes that only 1 percent of online players are willing to spend money to cheat on top of an already expensive hobby. Even by that estimate, Counter-Strike: Global Offensive alone had a potential 25,000 cheaters out of a total of 2.5 million unique players last month. Put on your green accountant visor, add up the player-bases of all the other popular multiplayer games cheat providers are servicing (Call of Duty, Battlefield, Rising Storm), and you ll see a massively profitable market.
I wanted to cheat in CS:GO. I was good, once, when I had a high school student's endless free time to pour into Counter-Strike 1.3. These days, if I can play with friends, it s fun. If I jump onto a random server I m cannon fodder.
I Googled Counter-Strike: Global Offensive cheats, and quickly ended up at a user-friendly cheat provider. Based on the size of its community and traffic, it s one of the biggest. I'm going to call it Ultra Cheats, a fake name, to protect the anonymity of the sources I talked to. Those sources, like Zero, have also had their online handles altered.
Ultra Cheats didn't accept credit (other sites did), so I used PayPal to buy a one-month subscription for CS:GO cheats for $10.95. This gave me access to the site s VIP forums where I could talk to other members, administrators, cheat coders, and download Ultra Cheats cheat loader, which checks in with its DRM server. It also gave me access to around-the-clock technical and customer support via TeamSpeak.
I followed a simple list of steps, including disabling Windows default anti-virus protection. I launched a new copy of CS:GO on a fresh Steam account belonging to Perry C. Gamble, loaded the cheat using the cheat loader, and entered a match. For the first time, I wasn't just another player, but a kind of god.
The most obvious of my new superhuman abilities was spying on other players through walls. In CS:GO, wallhacking is incredibly useful. Faceoffs around corners come down to millisecond reactions. My ability to see exactly when the enemy was coming, or to know exactly where he was hiding when I was coming, was unfair to say the least.
It was also super fun. Maybe the most fun I've had with Counter-Strike in years. I was finally getting kills, more than one in a round, but I wasn't crushing everyone else. It was like a little boost that got me back into my high school fighting shape.
I wanted to see how far I could push it. I was paying for this. I wanted to feel powerful and get my money s worth. I turned on auto-aim, and auto-trigger, which fires your weapon automatically when you point your cursor at an enemy.
I played with these options and others for a handful of matches. They didn't seem as useful as wallhacking, or they simply didn't work as well, but I was vote-kicked out of a match before I could make an educated decision. Halfway into my next match, two hours total since I started cheating, I was VAC-banned from CS:GO.
Counter-terrorists win?
VAC bans are usually irreversible. Perry C. Gamble would never play another match of CS:GO unless he opened another Steam account and bought another copy of the game. That s where the charm of cheating wore off for me. It was fun while it lasted, but I couldn t imagine paying another $15 for a new copy of CS:GO plus the ongoing $10.95 a month Ultra Cheats membership just to get easy kills.
John Gibson, president of Tripwire Interactive (Rising Storm, Killing Floor) told me plenty of cheaters feel differently. We see a spike in hackers after we have a sale on one of our games, he said. Their last 10 Steam accounts have been banned, and the game is on sale for $3, so they ll buy 10 copies for $30 on 10 different accounts and they ll keep cheating.
I told Gibson that I found that behavior mind-boggling. He isn t confused by it. He s just angry. Give me five minutes alone with a hacker or a hack writer, he laughed. That s what I think about that mindset.
Newell called cheating a negative-sum game, where a minority benefits less than the majority is harmed. It s obvious Valve and other developers take the issue seriously, but talking to Gibson made me realize it s also personal. Before he would even talk to me, I had to prove that I wrote for PC Gamer. He s been burned before. One of his first experiences with a hacker was someone who pretended to be a journalist with a fake, up-to-date gaming blog. He leveraged his early access to Tripwire and other developers games to provide hacks and pirate games.
He s in jail now for stealing credit card data, not cheating.
Gibson told me that, legally, it s not worth going after sites like Ultra Cheats. Most of them are based out of Russia, China (Ultra Cheats is registered in Beijing), or other places where extradition is, in Gibson's words, questionable. At the very least, Tripwire would have to pay another lawyer in that country, making it prohibitively expensive and complicated.
Criminal justice systems, perhaps understandably, aren't preoccupied with people cheating in online games. Especially when it s international, Gibson said. Then you re talking about the FBI and Interpol. If someone stole $10 million in diamonds, call them. If someone is hacking your game, they don t care.
If Tripwire, Valve, or other developers want to reduce the number of cheaters, they have to do it themselves. Note that it s reduce and not eliminate. Like Newell, Gibson knows that this isn't a battle he can finish. It s like the Wild West, he said. It s more about managing the risk and hacks without inconveniencing your legitimate players too much.
Tripwire s anti-cheat strategy is three-pronged. The first is technical, using both VAC and Punkbuster. This is one topic Gibson was secretive about, but he said Tripwire uses both because they handle things in different ways.
"If Tripwire, Valve, or other developers want to reduce the number of cheaters, they have to do it themselves."
The second is being a proactive developer. When Tripwire notices a loophole, it closes it as fast as possible. When Red Orchestra 2 first launched, it didn't do a whole lot of server-side validation on hit detection. The game was plagued by hacks that allowed your machine to tell the server you shot someone in the head even when you were clear across the map. Very quickly we put up an update that basically verified, within a reasonable margin of error, that they kind of have to be where you say you shoot them at, Gibson said. If they re not, then we know that it s a hack and we ignore that shot.
The third is having an engaged server admin community and giving them the tools to be the third line of defense. That s a huge thing for us, Gibson said. Hackers come in, it s obvious fairly quickly that they re hacking, the server admin bans them from the server and problem solved.
Punkbuster also allows server admins to take screenshots of what players see. If the server admin captures evidence of cheating, he or she can submit the proof to PBBans, a global database of hackers, making it very difficult for that hacker to join any Punkbuster servers.
This also allows server admins to pass along evidence of cheating to Tripwire, which can use the information to close more loopholes.
Overall, Gibson thinks this strategy works very well. I have over 1,275 hours in Red Orchestra 2 and Rising Storm, he said. I ve been on a server with about two hackers in all that time. I asked him if Tripwire downloads paid cheats as part of its efforts to prevent them. We re a proactive dev, he chuckled. Infer from that what you will.
Gross Income
After being banned from Counter-Strike, I spent several weeks poking around the Ultra Cheats forums hoping that someone would talk to me about how the site was managed. I only got real attention once I admitted that I was writing a piece for PC Gamer. I bounced from admin to admin until I got to Slayer, Ultra Cheats manager and lead coder.
Slayer didn't want to talk at first. I don t think any good for Ultra Cheats would come from this, he said. I promised him I wouldn t use any real handles or even the site s real name, and that I wanted him to respond to quotes from developers like Gibson. I suspect the notion that he d get a reaction from a game developer is what got him on board.
Like Gibson, he needed confirmation that I was really writing for PC Gamer, and he was more thorough about it. I gave him my real email address and name (not Perry C. Gamble s), Twitter, and an email confirmation from an editor.
Gibson was worried about hackers posing as journalists. Slayer was worried about giving legal ammunition to parties that want Ultra Cheats gone, and competing cheat providers.
We set a date to talk over Skype, but when the time came Slayer wouldn t agree to a voice call, just text, because he was worried about me recording him as well as other reasons. To my surprise, he brought along another Ultra Cheats administrator, Prophet, and they d only talk to me together. I guessed that this was to keep one another from saying anything they might regret.
They said part of Ultra Cheats money comes from a different site that it operates in Brazil (a huge gaming market) and reseller sites, which sell Ultra Cheats product under a different brand in exchange for a cut of sales.
Slayer said that Zero s $1.25 million a year was a little inflated, but that I could come up with a rough estimate of Ultra Cheats annual revenue by gauging the size of the community.
On March 20, over 2,500 members logged into the Ultra Cheats forums, almost all of whom are plainly listed as paying for standard or more expensive cheat packages. At an average of $10 per user a month, Ultra Cheats makes $300,000 a year. Add to this the fact that the forum has almost 150,000 members overall (though we don t know how many are active, paying users), the Brazil site, and resellers, and it s not hard to imagine Ultra Cheats breaking a million dollars a year. Slayer declined to share the exact number of their active users.
He said coders supply cheats on the site in exchange for a cut of the sale. These vendors, as Slayer calls them, take in about half the profits of the whole operation. Both Prophet and Slayer said that they get paid enough, but not enough to quit their day jobs. More than minimum wage, they said. Customer support, technical support, and other people like Zero who help run the site get paid as well, but less. Zero didn t want to say how much he makes, but admitted that he has a day job and that free cheats attracted him to the position.
I do this because I really think of the community and staff as a big family, Prophet said.
The rest of the money goes to the ownership entity, which Slayer and Prophet refused to talk about in any way. All they would say is that the entity controls the PayPal account I paid (and hence all Ultra Cheats' money) and that only Slayer knows anything about it. Anything between this ownership entity and the rest of Ultra Cheats goes through him. For all I know, this ownership entity doesn t even exist and Slayer and Prophet were the actual owners.
Rage cheaters and closet cheaters
Gibson said that if you cheat, you always get detected eventually. After talking to cheaters, I m not sure that developers are as effective at preventing cheats as they think. According to Slayer, there are two kinds of cheaters: rage hackers and closet hackers. A rage hacker is someone who uses cheats to their fullest potential, even employing features that kill everyone on the server instantly. They're the ones you notice and hate.
Zero said that if it wasn't for hacking, games wouldn't be fun. He said cheating is a rush, similar to the one he got when he used to deface websites. In life, you re always going to have rebels, he said. It s like coming up to someone and asking, 'Why do you rape or kill?' But in this case it s cheating.
Since he compared cheating to the worst crimes a human can inflict on another human, I asked him if that means he thinks it s a bad thing. He didn't answer. I asked him how he would feel if he was in a game with another player who was using cheats against him. Doesn't matter to me because he s probably one of our customers, he said.
Slayer agrees with Gibson that anti-cheats like VAC and Punkbuster, which work similarly to anti-virus software, are effective at catching ragers and detecting public cheats quickly. But their methods are so reverse-engineered it s not even funny, he said. Punkbuster's signature scans are easily dumped using public knowledge available on public forums. If you re smart enough and you know the methods they employ, you can get around it easily.
"In life, you re always going to have rebels. It s like coming up to someone and asking, 'Why do you rape or kill?' But in this case it s cheating.' "
Punkbuster is basically defeated, Slayer said. If I write cheats and give them away on a public forum I can have my cheat up and running in 20 seconds because I found out exactly what they detected. If I was smart I would build that into my cheat and have my cheat fix itself on the fly, which isn t a stretch. Call of Duty dropped Punkbuster for a reason.
I asked Slayer why Valve, for example, doesn't download his cheats, track the server, block it, and come after him. If it wasn't obvious already, I wasn't a Computer Science major. Slayer is, and my questions amused him. You could do that, but what if I cycle my server IP every day, or every hour? Or I could reasonably and securely move DRM to the client with check on a less regular basis, or I could just spoof what VAC sees :). To be honest Emanuel, I can rent a server using a prepaid credit card via a VPN in another country and you will NEVER find who rented it.
Closet hackers hide the fact that they cheat. I'm proof that cheaters do get caught Steam banned me after a little more than two hours of aggressive, blatant cheating but members of the Ultra Cheats community told me that I was simply doing it wrong. In one of the most friendly, polite exchanges I ve ever had with online strangers, especially in the gaming sphere, they gave me tips on how to cheat without being detected.
Play like you re not hacking, one user who s been cheating in CS:GO with the same Steam account for over 250 hours told me. Play as you would normally, only you re able to see through walls. Act.
That means don t stare at walls, don t use an aimbot (since it moves the camera erratically and results in unreasonable kills), and make sure someone kills you in every match. He also believed you re less likely to get banned if you buy in-game items and get some hours in before you start cheating. He suggested that next time, I should launch the game and let it idle for a few hours before I do anything.
Another cheater suggested I practice cheating in free-to-play games. That s what I love about free games, he said. You can just keep coming back and there s nothing they can do about it.
If you re a good closet hacker you also won t get caught by statistical anti-cheats like FairFight, used in Titanfall and other Electronic Arts games, or Overwatch, another, peer-review layer of CS:GO s anti-cheat strategy, where approved players view flagged replay footage and vote on whether another player was cheating.
Image via free-hacks.com
Tripwire closes loopholes as fast as possible, but Ultra Cheats is fast too. If a vendor s cheat stops working, Ultra Cheats stops selling it and the money stops flowing. Detected cheats come back online within hours, days at the most.
And these are only the cheats that we know about. Anti-cheat can t detect what it can t get its hands on, as Slayer said. Between that and the proficient closet cheaters, I can guarantee that you ve played with way more cheaters than you think.
Supply and demand
If closet cheaters aren't trying to crush other players, why do they turn to cheats in the first place? Prophet started cheating so he could play with his kids. He s over 50, and suffers from a serious visual impairment. He says that without ESP (extrasensory perception), part of the wallhacking cheat that highlights enemy players with bright red boxes, he wouldn't be able to keep up. If I did not use cheats I would not be playing at all, he said.
Slayer said that they've heard from a few other people with disabilities who use cheats this way. It enables them to enjoy a game like you or I would normally, without cheats, he said. But even if there weren't players with disabilities cheating to rise to a normal level of play, as Prophet calls it, the reality is some players will always feel that they want special assistance.
If matchmaking worked perfectly and everyone always felt like a capable player up against equally skilled opponents, maybe there would be fewer of the closet cheaters that make Ultra Cheats a profitable business. When matchmaking works, you won't win every game, but you'll never feel dominated. It s like a friendly neighborhood basketball game. When it doesn't work, it feels like being mercilessly dunked on by LeBron James. That's not fun.
Image via 47r-squad.com
At that point some players dedicate a significant amount of time to get better. Others quit. A small minority turns to cheats. Even Slayer admits that what he does isn t good for games, but as long as there are enough of the latter he ll provide supply where there s demand.
Ultimately, the most effective anti-cheat strategy is to make cheating feel unnecessary. That means either more sophisticated, accurate matchmaking or some kind of handicap system, which some fighting games (Street Fighter IV, Smash Bros.) already implement.
Similar solutions in other games won t stop ragers. Nothing will. But they'll get caught, eventually. For closet cheaters, it might offer a legitimate way to play with others and undercut the paid cheats business.
Until then, this cycle is unstoppable, as Slayer said. If we didn't do it, someone else would.
