Cheating in Counter-Strike: Encyclopedia II - Cheating in Counter-Strike - History of Cheating in Counter-Strike

Cheating in Counter-Strike - History of Cheating in Counter-Strike

Up to late 2000, it is safe to say that cheats were a more isolated, if annoying phenomenon, and only started to become such a raging problem for the community in as late as 2001. By late 2004, the battle against cheating seemed utterly lost, with the numbers of cheaters continuously increasing and anti-cheat utilities slowly giving up their uphill battle.

The History of Cheating in Counter-Strike is as long as the history of Counter-Strike itself, as cheating has been with Counter-Strike from the very beginning in 1999, although only in 2001, the problem became so apparent and painful that Counter-Strike became the synonym with cheating that it is today.

Cheating in Counter-Strike - 1999 - 2000

When Counter-Strike hit the scene, it was an almost immediate success. However, cheating appeared to be a problem from the start. Both Half-Life deathmatch, Team Fortress Classic and Action Halflife were popular mods at the time, and primitive protohacks were ported from these mods.

Altered versions of a particular file, client.dll, allowed so-called headshot scripts and gave players norecoil (a basic type of aiming help intended to reduce or negate the recoil that made aiming with most guns in Counter-Strike so tricky). Because similar hacks had been appearing for Team Fortress Classic and Action Half-Life, Valve updated server software so Half-Life servers verified the client.dll file of the players, hindering such hacks. Included with other updates, functionality of many variables that allowed an unfair advantage like lambert (which could be used to reduce the effect of a flashbang), were removed or toned down.

At this time, cheats weren't deemed too big of a problem, as they either lacked the necessary power to make them useful (compare a headshot script attempt, to contemporary multihacks with zero recoil and fully automatic headshots), or were easily detected. Stealth was not considered at this time: a wallhacker would just stand behind a closed door and gun down everything he or she could see. Cheating at this point was not a way to damage competitive gameplay, but more of a new way disruptive players could harm the gaming experience of others. However, cheating subtly in online competitions occurred very soon, and occasionally even LAN parties, as simple cheats like 'spiked models' or 'lambert' weren't as stigmatized and detested by the mainstream community as they were after OGC ravaged the public servers.

XQZ was a true milestone in Counter-Strike hacking. Not only did it include a highly lethal aimbot, and a relatively simple to use interface, but it featured wallhacks, and if desired, almost complete stealth. Initially XQZ was a private hack, but eventually it was released to the public. It relied on replacing (and in later versions, hooking) the OpenGL DLL file for Microsoft Windows systems (opengl.dll) instead of replacing the client.dll.

This combination of an aimbot and stealth made XQZ truly lethal for its time. It could be configured to not give any indication of the presence of a hack on the screen, and the aimbot could be turned on and off through subtle keyboard commands. Thus, it could be used, like what it was designed for, at a LAN party, without anyone suspecting the cheating player to be anymore than 'a good shot'.

Up to today, the legacy of XQZ, its various rewrites, extensions and rip-offs dominate subtle and competitive cheating in Counter-Strike.

Cheating in Counter-Strike - 2001 - 2002

In 2001, a new public cheat appeared in the scene: OGC for Counter-Strike. OGC, short for "Online Game Cheats", became synonymous with easily-installed, powerful, multifunctional hacks that supplied the cheater with everything, from a strong aimbot to a built-in MP3 player.

Before arrival of OGC, most cheaters were easily identified due to clumsy wallhack tactics, or more rarely, claiming to be professional players where, due to their mundane tactics and simplistic play, it was obvious that they were amateurs. Thus Counter-Strike remained relatively cheat-free until early 2001. When OGC arrived, everyone had the opportunity to completely annihilate an entire team of experienced players swiftly and violently or they could subtly just use an aimbot with a low-key configuration or a wallhack without any blatant exploiting to enhance their score.

When gameplay became more and more unbearable on public servers, the outcry was loud enough to create a long succession of anti-cheat tools.

As early as 2000, Punkbuster tried to rid the scene of cheats, as it used variable checking and process validation while authorizing with the server. Soon it was followed by the short-lived, server-based 'TSC' which was the first anti-cheat tool able to detect OGC. It however was quickly rendered useless as an anti-cheat mechanism by OGC’s very fast development cycle. CSGuard by OLO, another server based plugin, could utilize a script to check on variables and filenames. CSGuard was the first anti-cheat mechanism which could stop early versions of OGC consistently, along with hundreds of cheats and violations, as it was script based, and its scripts could be updated as soon as a new cheat was discovered. With its successor HLGuard, it is the only anti-cheat mechanism still in use in Counter-Strike, while Punkbuster stopped supporting CS and moved on to other FPS like Americas Army or Quake 3 Arena

Cheating-Death is still used today and is thought by many as one of the best anti-cheat mechanism available. Its strategy is not to detect a cheat but to prevent its working in the first place. Anti-cheats like CSGuard merely checked for the presence of an already-known cheat, which required constant updating. This made such tools completely ineffective against private hacks. Cheating-Death (C-D), on the other hand, made it harder to develop working cheats, although in time C-D produced its own Code Race similar to HLGuard and Punkbuster, with cheat coders constantly finding new ways to disable and circumvent C-D.

In 2002, Valve Software released Counter-Strike update 1.4, which included VAC. VAC was Valve’s answer to many players' prayers, as VAC (a client-side implementation integrated into the Half-Life engine) could be enforced by the server and didn't require any special work from the players. Forcing the players to install a separate program and keep it up to date was what kept many server admins from implementing other, less integrated client-based anti-cheat tools like the failing PunkBuster or the more successful Cheating-Death.

VAC however, had another advantage. Valve was able to ban an offender from accessing any VAC server ever again with the WON ID with which they were caught. While some cheaters may have been able to acquire new WON IDs, a large percentage of the regular, disruptive cheaters were eventually removed from VAC-secured servers and had to resort to servers which did not utilize VAC. Thus cheating in the game became much less of a nuisance to regular players on VAC servers.

Cheating in Counter-Strike - 2003 - 2004

Valve Software released Counter-Strike 1.6 in 2003. While it was delivered on Steam exclusively, there were not many changes to the engine and many hacks for Counter-Strike 1.5 continued to work, though sometimes only partially. Valve turned off WON in mid 2004, forcing the vast majority of the players to upgrade to 1.6. Some players however exploited the opportunity to continue use 1.5 on an alternative WON network, not operated by Valve. Today, 1.6 is the CS variant with the biggest population, although a small pocket of players are sticking with 1.5 even today.

The introduction of Steam also seems to have led to problems with the development of Cheating-Death as many of the smaller and more regular Steam updates are causing C-D to have issues.

In late 2004, Counter-Strike: Source was released. The Source engine (the engine Counter-Strike: Source uses) is a lot different from the original Half-Life engine, so it has yet to be tested against the ploys of cheaters, hackers, and mischievous players to the extent that the original engine was.

Cheating at a time required acquiring a private hack, since both VAC and Cheating-Death used to detect a public cheats within a few hours. Non-publicly released cheats remained the bane of the competitions due to anti-cheat developers being unable to analyze them. The effect of such nonpublic cheats however was at least reduced to a smaller user base than publicly available cheats. Underground trading of hacks became a side-business for many cheating clans and coders.

The state of affairs degenerated to a complete disaster for Valve Software, as VAC stopped receiving updates after March/April 2004. This had the effect of making cheating rife on public servers. In the following months, after a period of relative tranquility, it became more common for a blatant wallhack/speedbot/aimbot/spinhack to enter a server, only to have two thirds of the players who appeared to have been playing legitimately turn their own hacks on, in order to remain competitive and fight back.

The problem is further exacerbated by the No(n)-Steam/SiX-Steam exploit, which enables people to create Steam accounts at will with full access to all of Valve’s titles through Valve Software’s Steam software distribution platform. Because of Valve’s policy regarding VAC, where cheats are not instantly banned, even when VAC2 does eventually catch up with cheats and bans their Steam account, it appears that cheats will still be able to generate a new Steam account and resume cheating.

In January of 2005, however, Valve Software upgraded their "ticket system". Now people using a Steam exploit such as No(n)-Steam or SiX-Steam must have a legal, purchased copy of Half-Life or any of its mods on their Steam account in order to play any game. For example, a normal user could only play Counter-Strike: Source if they had it purchased and on their account. Before January 2005, anyone using a Steam exploit could play it. Now, you must have Half-Life or Half-Life 2 registered on your account in order to play it. This has reduced the number of exploiters, as most of them do not wish to risk getting their pricey account permanently revoked.

Cheating in Counter-Strike - Today

As of August 2005, cheats in Counter-Strike:Source have almost disappeared from VAC2-enabled Source servers, whereas the situation seems almost unchanged in VAC2-enabled Counter-Strike 1.6 servers. Whether the introduction of VAC2 will result in a mass ban in Counter-Strike v1.6 remains to be seen, but there does seem to be a major discrepancy between the numbers of cheats in Source. One explanation for this may be that it is easier to protect CS:S because it is Direct3D only whereas CS 1.6 uses both Direct3D and OpenGL.

The biggest change of VAC over other anti-cheats however is the delayed banning system, that gives any detected user a high, but not 100% probability to have his Steam privileges removed by the end of a several-weeks cycle, depriving the mainstream cheaters of accurate informations on which cheats are currently detected and how.

The main drawback for this approach is that a large number of cheaters are rampaging public servers, unaware that they will be banned at a later date, or even while aware, exploiting the time given to them for destructive behavior. This means that often while public servers appear cheat-free at the beginning of the week, they seem 1.6ish at the end.

The large amount of experience with the cheats/anti-cheat race and the very large number of cheaters in Counter-Strike additionally seem to have spoiled many cheaters. In a lucrative turn of events for Valve, incidents are known where cheaters get 2 or 3 legitimate steam accounts banned, only to cheat happily with their newest one.

Adapted from the Wikipedia article "History of Cheating in Counter-Strike", under the G.N U Free Docmentation License. Please also see http://en.wikipedia.org/wiki