Valve Anti-Cheat is the software first developed for Counter-Strike and used in at least 60 other Steam games. It does not and never has sent your browsing history to Valve so that they can peruse your favourite porn sites.
That was the worry of some concerned Redditors, who suspected that VAC transmitted DNS cache information – i.e. the IP addresses you’ve visited – to the company to determine who’s cheating and who’s not. As users began to list potential uses of DNS information for far greater nefarity, our lord and saviour Gabe Newell made a rare public address to counter the claims.
“Do we care what porn sites you visit?,” he wrote. “Oh, dear god, no. My brain just melted.”
Cheat developers, Gabe explained, have a problem getting cheaters to pay them (probably because their market is made up exclusively of liars and swindlers). Consequently, cheat software for games like Counter-Strike often comes with DRM and anti-cheat code of its own, and requires players to touch base with a server to check they’ve paid – like Adobe, but for dicks.
Rather than raking users’ PCs for DNS information, then, Valve Anti-Cheat looks specifically for cheats which “phone home” to DRM servers.
In a recent mass sweep that prompted concern among users, VAC checked for the presence of DRM-laden cheat software – and if it found it, checked that user’s DNS cache for a match with those cheat DRM servers.
Only a tenth of 1% of client PCs triggered that second check and had DNS entries sent to Valve’s servers – where the match was double checked, and the user marked for a future ban. 570 cheaters will be banned as a result.
Gabe painted a slightly grim picture of Valve’s ongoing fight with DRM-coding cheat providers. Since the VAC test described above, cheaters have begun manipulating the DNS cache of their customers’ PCs to avoid detection – the very worry Redditors had about Valve. Ultimately, Valve’s goal is to make cheat development more expensive than the potential gains.
One weapon the cheaters do have, said Gabe, is “social engineering”.
“If ‘Valve is evil – look they are tracking all of the websites you visit’ is an idea that gets traction, then that is to the benefit of cheaters and cheat creators,” he wrote. “VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky.
“For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light.”
Valve’s response is exactly this – to make the process transparent, and to let users know they “try really hard to earn and keep your trust”. Have they retained yours?
Rust developers Facepunchrecently supplemented VAC with their own, homebrew anti-cheat system. They were apparently tired of waiting for it to kick in. Is that long wait for bans something you’ve noticed in Counter-Strike and Rust too?