Online gaming's cheating heart

Online cheaters can suck the fun--and profit--out of a game by introducing homemade characters with unauthorized powers, making it impossible for opponents to win or even survive.

David Becker Staff Writer, CNET News.com
David Becker
covers games and gadgets.
David Becker
8 min read
Rick Cortese knew he was in a dicey neighborhood, so he made sure he locked his doors before he went to sleep. But crooks still managed to loot his home, sucking valuable possessions right through the walls.

The theft happened in the virtual world of "Ultima Online," one of the first popular online role-playing games, but it was a headache nonetheless and an example of the kind of cheating likely to thwart game publishers as they try to push more customers online.

Although online worlds such as "Ultima Online" and "EverQuest" account for only a small chunk of the game industry today, it's a profitable chunk, accounting for $210 million in revenue last year. Game publishers and analysts expect the segment to grow significantly in the next few years--to as much as $1.8 billion in 2005 by some estimates. That's because online games based on popular franchises such as "The Sims" and "Star Wars" will start cropping up to lure mainstream consumers into the arena.

Game companies are looking to subscription fees from online players as a major source of recurring revenue in the near future, with leading games publisher Electronic Arts predicting that 400,000 subscribers will be paying about $15 a month for "The Sims Online" by the end of its current fiscal year.

But those subscribers may not stay around if the new virtual worlds are full of the cheating and hacking that has marred previous online games. A small but fractious minority in online gaming circles, cheaters can suck the fun out of a game by introducing homemade characters with unauthorized powers, making it impossible for opponents to win or even survive. They can also quickly pollute the social atmosphere critical to many games.

"The cheaters are real fiction breakers, to say the least," said Cortese, a Los Gatos, Calif., chemist. "Nothing like fighting a guy that has a cheated character with twice your stats to put you off of a game. A lot of the third-party cheat programs gave people such a huge advantage it pretty much killed the (player vs. player) experience in the game for most people."

Matt Pritchard, a game developer at Ensemble Studios, best known for its "Age of Empires" series of strategy games, said cheating will become a particularly important issue as players without much online gaming experience enter the market.

"Nobody wants to pay a certain amount of money each month just to be killed off by a troll the minute they log in."
-- Michael Gartenberg, research director for Jupiter Media Metrix
"Cheaters get their kicks out of ruining the experience for other people," Pritchard said. "The people who are going to be most turned off by that are the newcomers. The hardcore gamers kind of know the lay of the land; they know if they have a problem, they can just find a server. But if you've got a 12-year-old girl going online to play 'The Sims,' and somebody figures out a way to destroy the character she's spent a lot of time developing--she's not coming back.

"If the average person goes out there and they have a bad entertainment experience, why are they going to continue to pay $9.95 to experience this crappy world?" Pritchard said.

Game publishers are obviously listening. At the recent E3 trade show in Los Angeles, one of the gaming industry's major shindigs, the issue made itself felt. A presentation for Xbox Live, Microsoft's online service for its game console, stressed hack-proof servers. And announcements surrounding upcoming PC games such as "Star Wars Galaxies" and "The Sims Online" discussed security measures that are being built into the games.

Michael Gartenberg, research director for research firm Jupiter Media Metrix, said security will be an important selling point in convincing consumers to invest the time and money such games will require.

"We're going to see a lot of investment in systems with military-grade security," Gartenberg said. "Protecting the integrity of players who invested significant time and money in these games is going to be very important. Nobody wants to pay a certain amount of money each month just to be killed off by a troll the minute they log in."

More than one way to break the rules
But thwarting cheaters won't be a simple matter, owing to the varied ways in which miscreants can bend or break the rules of online games. Common cheats in massively multiplayer online games such as "Ultima Online" and "EverQuest" include "trade hacks" that let players illicitly acquire in-game goods.

"You never see these anti-cheat tools get anywhere. They're successful for a few weeks, but then somebody figures out how to break them."
-- Michael Bacarella, a New York software developer
Another tactic is to employ automated programs that keep a character in play, allowing the character to quickly acquire new skills. "You're using a bot to play the character 24 hours a day, so you can go up from one level to the next without doing anything," said Erica MacGilp, co-founder of the Eternal Circle Association, a group formed last year to promote cheat-free gaming.

In multi-player action games such as "Quake III" and "Half-Life," hackers will try to tap into the servers running online games to execute cheats that let them see through walls or automatically aim weapons.

Then there are the troublemakers who tamper with the social interaction essential to many online games. "A lot of these games are as much about the social experience as the game play," Pritchard said. "If someone's running a bot that puts a constant string of profanity across the chat screen, that pretty much destroys that aspect of the game."

Pritchard said the first line of defense against cheaters has to be technological, with developers looking for ways to break the game and building in appropriate defenses from the start.

"If the online component of the game is significant, you need someone thinking like a hacker up front," Pritchard said. "With 'Age of Empires,' we didn't design the game thinking about all the things people could do to muck with it. We found later there were ways to re-architect it so that a person who was cheating became incompatible with all the people he was playing with, and then they'd kick him out. It was a lot of meticulous detail work, but I think it really contributed to the success of the game."

Pritchard added that game developers could to do more to educate one another.

"There's not been a good sharing of information within the industry as far as dealing with cheating," Pritchard said. "The developers are happy for us to hang out in chat rooms and talk about C++ programming, but talking about cheats makes them nervous. If they admit to their games being hacked, they feel like they're being opened up to liability."

Software developer Tony Ray said that though it's impossible to prevent every type of cheat, good anti-cheat technology can shut cheaters down almost as soon as they emerge. PunkBuster, software Ray originally developed for the action game "Half-Life" and its offshoots, resides on the player's PC, checking for known exploits and shutting down a game if it finds any.

"It's sort of like a virus scanner in that it scans the PC for any kind of exploit," Ray said. "The user basically trades some privacy for the ability to play on a level playing field, which is what the vast majority of players want."

Ray has built a version of PunkBuster into the popular action game "Return to Castle Wolfenstein" and is working with other developers to build similar anti-cheat mechanisms into their games. He's confident such features will become mandatory as online gaming spreads.

"I think within the next few years, if your online multiplayer game can't promote being cheat-free, you're not going to be able survive," Ray said. "It's so frustrating to start a game and get killed off right away because some guy is using an exploit. People will just leave and go someplace that can ensure them that they'll have a fair game."

Neighborhood watch
But technology alone isn't likely to do the job. Scott McDaniel, vice president of marketing for "EverQuest" publisher Sony Online Entertainment, said Sony has worked hard to block cheats in the "EverQuest" PC software and server technology. But much of the credit for keeping the game clean goes to the 120-person customer support staff that Sony employs for the game and fellow players who quickly report suspicious activity.

"Most of our notification of people breaking the rules come from other players," McDaniel said. "They want to keep the game fair, so they're very good at letting us know when they think something's wrong.

"We try to treat everybody as a reasonable adult," McDaniel added, "but if push comes to shove, we will ban characters and accounts. We do our best to ensure that all our players have an equitable, fair gaming experience."

Mythic Entertainment's "Dark Age of Camelot" has become one of the fastest-growing paid online games partly because it has reacted seriously and promptly to any reports of cheating, said Mythic President Mark Jacobs.

"We have a very straightforward attitude to cheating: We see it; you're gone," Jacobs said. "I will happily sacrifice a small portion of my paying customers to ensure the rest of them have a quality experience."

Such monitoring accounts for a significant part of the expense of running an online game, said David Cole, president of research firm DFC Intelligence.

"It becomes a major challenge to have a customer service network monitoring everything on an ongoing basis, but you have to do it," Cole said. "The big risk is that you start getting real high churn if you don't. New players get fed up and just say, 'Forget it.'"

ECA co-founder Cory Nott said technology can go only so far in stopping cheaters. "It's really important to shut down the exploits as soon as possible, but I think there has to be a social aspect to any anti-cheating measure. Honest players basically have the same goals, and if they have the right tools, they can police themselves very well."

ECA's approach is to form a sort of neighborhood watch for online games. Players who join the group pledge to play cheat-free. Anyone found violating that pledge is publicly removed from the group. "We're promoting trust, playing with people you know and respect," MacGilp said.

Michael Bacarella, a New York software developer and aficionado of online action games such as "Doom" and "Half-Life," envisions a system similar to eBay's feedback ratings, with game companies maintaining a central repository where players could rate one another for honesty. The result would be a "network of trust," with honest players given reliable tools to find one another.

"I think if game communities started using tools to help players regulate themselves, it would be much more effective than chasing another software fix," Bacarella said. "You never see these anti-cheat tools get anywhere. They're successful for a few weeks, but then somebody figures out how to break them."