Complaints from honest players about the multitude of cheaters in CS:GO have long ceased to surprise anyone. Cybersport.ru talks about the types of cheats that are out there, how Valve defends against crooked players, and how the defense failed their test.
Part 1, theory: What cheats exist and what happens if you’re caught using one?
Cheats can be classified by distribution type as free, paid, private, and unique.
Free cheats are available to all. They have scant functionality and next to no detection evasion. It usually takes no more than a month for Valve to become aware of these programs. Barely any are new code; they’re copies of other cheats, which may include further malicious software.
It’s much less often that Valve uncovers paid cheats. Their developers charge either a monthly or a one-time fee for access. Here, functionality is ampler, and algorithms for specific functions vary between cheats, as do code infiltration techniques. Some paid cheats have gone undetected for years.
Some developers seek to not only release the program itself, but also insure its users against a VAC ban to the maximum possible degree. They sell private cheats, which are only available to a close inner circle. Such a scheme reduces the chance of detection to nearly zero.
The rarest type are unique cheats, which are often custom-named. A developer told us about them on condition of anonymity.
I developed one for a pretty famous YouTuber, I won’t say who. I don’t even know if he makes videos anymore. But back then, I made a couple of thousand dollars on that code. He played well enough on his own, without any programs, but there was certain stuff he needed.
The majority of cheats have a number of functions in common.
Aimbots are notorious and self-explanatory. The cheat will automatically point the cursor at an enemy, and the player only has to press the button. Actually, you don’t even have to bother about that if you also add a triggerbot. When that function is on, shots will be auto-fired as soon as there’s a target in the crosshair. An aimbot might seem easy to detect; a seasoned player can recognize it instantly. However, an aimbot can have lots of fine-tuned settings, such as FOV — which effectively means the threshold distance between crosshair and target at which the auto-aim activates. The higher a cheater’s individual skill, the lower they set this which makes it virtually impossible to tell if there’s some software nudging their crosshair by those few millimeters. You can also adjust the aiming speed to match your mouse sensitivity, set a delay before auto-aim engages, and so on.
Wallhacks let you see enemies through walls and sheltering obstacles, thus becoming aware of the enemy’s every move. It’s most often used in pre-firing, the just-in-case couple of volleys before actually facing the enemy. Wallhacks also have a very useful setting SoundESP. It's well-known that experienced CS players can detect enemies by the sound of their footsteps: SoundESP shows when an enemy is heard, and thus can be fired upon without implicating oneself. Radarhack is a variation of the wallhack in the form of a radar which shows both visible enemies and ones that the cheater has no information about.
Popular programs have client bases reaching into the tens of thousands, and coders earn up to a million rubles ($17,671) a month.
There's also a cheat called recoil control system (RCS). Controlling bullet spread is a very complicated part of shooting in CS:GO. That spread isn’t random, though and it follows pre-programmed patterns. RCS is a function that compensates for the spread and keeps firing at approximately the same spot. This turns CS:GO into a casual FPS where firing in bursts isn’t a necessity. The program will autocorrect mouse movements to concentrate fire. The function can be set to a zero spread as well as a more or less believable one.
Demand for this software has grown so much in recent years that we can now talk of a true market for it. I counted at least 39 known paid cheats by Russian developers. Monthly subscription costs between 200 and 1,000 rubles ($3.53–$17.67). Virtually none of the cheats I found had a 100 percent VAC detection rate; bans tended to be selective. According to our source, popular programs have client bases reaching into the tens of thousands, and coders earn up to a million rubles ($17,671) a month.
The Source engine allows the player to fine-tune certain parameters using its console. Developers obviously have an even freer hand. The system’s openness allows them to find the most unorthodox vulnerabilities and use them in their product.
I’ve got cheats for other games as well, but in CS:GO, a lot more necessary values are processed on the client side. I can’t say this simplifies development, but there’s certainly a wider functionality potential. Besides, CS cheats are the ones in highest demand.
It went as far as instant bomb explosion or defusal. Valve quickly fixed that vulnerability, but another way in was found in January. For a week now, a popular program has included this function, and it works, while the creators of CS:GO seem not to be paying attention.
Some programs have FakeLag, which is just what it says on the tin. To an enemy, your player model appears twitchy and moving in jerks, which makes aiming harder. Bunnyhopping without strafing or other complex moves is another cheat staple. You just hammer away at Space without losing speed.
Some functions are purely aesthetic. They include a convenient UI, customizable model color schemes for wallhacks, an enemy health bar, their weapons, and even displaying the rank of both allies and opponents.
There’s little to no chance of playing a string of matches without once running into a cheater.
Cheats have become all too common in CS:GO matchmaking for the problem to keep passing under the radar. Even if every cheat has no more than a thousand subscribers, the total number will be in the hundreds of thousands. There’s little to no chance of playing a string of matches without once running into a cheater. And those who’ve never dealt with cheating or researched the issue may not even notice a crooked player on the opposing team or their own.
Where's VAC and what does it do?
Valve Anti-Cheat (VAC) operates by scanning your computer’s hard drive and RAM. Valve maintains a server-side cheat database which it updates constantly, and when a file or process on the user’s machine matches one of those known to interfere with CS:GO, that player is blacklisted.
A VAC ban is also not instant. After an account has been caught running a cheat, a countdown starts and there’s no openly available information on how long it takes before a ban is issued. According to banned players and program developers, it can take between a week and two months. The countdown timer was added to make it harder for cheaters to determine when and in what circumstances VAC found their forbidden software.
VAC’s database can’t keep up with new cheats, however, and this prompted CS:GO’s devs to add an Overwatch function to the game. Whenever 11 reports are received within 24 hours, a demo of the alleged offender becomes available for viewing by experienced players, who then decide whether or not a cheat was used. They can’t know the player’s nickname or rank, nor see their skins or other potentially identifying features.
Prime matchmaking was introduced as another anti-cheat feature. It’s available to players who have reached Level 21 and through it Valve filter out those who get a VAC ban a few weeks after purchasing the game. To get Prime, you need to connect your phone number to your account: If the account is banned, others with the same phone number will be blocked as well.
Part two, practice: Global Elite in two months
At Cybersport.ru, we decided to see for ourselves just how bad the cheating problem is. I created a throwaway account, bought a popular paid cheat, and set a goal to reach Global Elite. I used cheats in every match. My usual rank, on my cheat-free account, is Gold Nova 4. To avoid my experiment getting cut short by VAC or Overwatch, I set up for maximum stealth: a small FOV on the aimbot, weak RCS, and strictly no hitting through smoke or walls. I also set the aimbot to not headshot every time; headshots accounted for a third of my kills at best. The wallhack and radarhack were always on. Two months and 168 in-game hours after purchasing the account, I was Global Elite. The cheats cost me approximately $11 for two months of subscription.
Two months and 168 in-game hours after purchasing the account, I was Global Elite.
The wallhack and radarhack gave me full intel on my enemies, but I was in no hurry to move to a particular point even if I knew the enemy was heading there. If I was holding B, I’d stay there until I heard about my teammates entering A on voice chat. Even if the enemy had taken a point, I’d try to retake it as neatly as possible — no wandering into the open in a 1v3 situation. I knew my shooting was essentially perfect (cheats, duh), and as soon as an enemy revealed themselves or missed, I’d promptly punish them. Most importantly, I never forgot about the grenades. Sometimes you need to throw them for no particular reason, but you’ll need at least one flashbang if you have to retake a point. I doubt that anyone would suspect anything if you blinded an enemy from around the corner every once in a few rounds. As for other grenades, you can throw them in the standard places just for appearance’s sake.
Even when I knew an enemy’s position, I’d often allow them to shoot me in the back, and only then turn around and send them to respawn with a precise headshot. Sometimes the enemy hit me in the head, killing me. But that’s what helps you not get caught. If all my teammates were doing a great job and didn’t need me, I could even play dumb, do a basic entrance without even checking the standard hideouts, and, predictably, die.
I only lost a single calibration match: there was another cheater on the opposing team. At 12-4 in our favor, the enemy turned on the Ragebot. Everyone has run into this kind of player at least once: you keep getting headshot through obstacles without even being seen. The cheater, meanwhile, is spinning around to prevent anyone from seeing where exactly they’re aiming. This is usually done by players who realize they’re up against a cheater. Turning on the Ragebot will either ensure your victory or provoke you to do the same, thereby proving that you’re a cheater. You’re guaranteed to get reported, Overwatch will get your demo, and they ban mercilessly for this kind of thing. The important thing is to not rise to the bait and accept defeat.
Before I reached Level 21, I got cheaters in every third match.
Calibration placed me at the highest rank possible, Legendary Eagle Master. While ranking up to Global Elite, I virtually always placed first in my team, with at least a +15 frag balance. In about a third of all my games, I was accused of cheating; but that happens often even when you’re playing fair.
Before I reached Level 21, I got cheaters in every third match, either on our side or the opposing one. In about one in eight games, an opponent turned on the Ragebot when defeat was imminent. And the higher the rank, the more cheaters there were.
After getting a Prime account, over ten games I only once ran into a cheater who blew their cover with Ragebot. Another one “carried” the game alone. They were betrayed by moments when their crosshair was moving suspiciously fast. Besides, throughout the game, they only checked the spots where enemies were actually hiding.
Going by our own experience, CS:GO has a cheating problem tjat has reached an unacceptable scale. Neither VAC nor Overwatch nor a Prime account protect you sufficiently. A developer told us that HD scans don’t help either:
You can say each copy of the software is a unique program. Almost all have different random strings of characters for names. Actually, no-one knows for sure if VAC does scan your hard drive, but that’s taken care of just in case. The thing is, it’s not the cheat itself that gets caught, just the injector. Meaning it’s all I have to replace, even if my software does get on the VAC list.
So the chances of being blacklisted by Valve are small. As for Overwatch, even with enough reports, proof beyond doubt is not a given. All you need to do is go easy on the settings and follow rules that are obvious to any experienced player: Like not aiming through walls before pre-fire.
CS:GO has a cheating problem tjat has reached an unacceptable scale.
So, what's the way out?
What are the alternatives for players who are sick of cheaters in CS:GO matchmaking? One’s first thought is the alternative platforms, ESEA and FACEIT. Their anti-cheat systems shut down most paid cheats. That doesn’t always help either, though. Some developers offer anti-cheat bypasses; a working, ESEA-safe cheat cost me just over $4 for a lifetime use. Processes can be manipulated in additional ways that allow bypassing cheat protection before launching the game client. However, FACEIT servers are set up differently, and certain functions of the programs simply don’t work there. ESEA’s anti-cheat uses an additional screen-grabbing algorithm. The platform’s bans are based on not just the account, but also the HDD serial number.
Even without software detection, the risk of getting banned on these platforms is fairly high. They have their own equivalent of Overwatch: administrators who review demos of potentially crooked player. They’re more competent than Valve’s Overwatch, and besides, there are much fewer players on ESEA and FACEIT than in regular matchmaking.
But ESEA moderators make mistakes too. In late 2017, Nikola “Lobanja” Mijomanović spoke out about several professional players getting banned for complaining about cheaters in Rank S. We’re going to check how substantiated such complaints are, too. Our next goal is to cheat our way to Rank S EU on ESEA. We’ll keep you posted!
Where's Valve in all this?
Only Valve can be the most efficient in combatting cheating. If Valve itself can’t cope, it can at least bring in third-party anticheats, such as BattleEye, the system used by PUBG and Rainbow Six. Granted, these games, too, have cheats that have gone undetected for over two months now, but they cost a lot, and they probably won’t be around for long. In November and December, PUBG devs reported 800,000 blocked accounts, meaning their anti-cheat campaign is in full swing. It’s anyone’s guess why Valve is holding on to VAC, which has been proven inefficient.
It’s anyone’s guess why Valve is holding on to VAC, which has been proven inefficient.
While it may be impossible to create a 100 percent reliable anti-cheat, Valve has other levers to pull: they can simply sue the developers of the cheats. Blizzard and Riot Games have already proven that it can be an efficient measure. CS:GO’s Chinese publisher, Perfect World, caught a cheat creator mere weeks after the game’s release and Tencent, the Chinese distributor of PUBG, helped the police track down 120 suspected cheat developers. At the same time, it’s not clear how deeply Valve are prepared to get involved. A year ago, the company went to war against roulettes, but only a few websites were shut down before that war ended; hundreds of roulettes are currently still in business.
None of this should be taken as endorsement of cheating by Cybersport.ru [and Cybersport.com — Ed]. Even the cheat developers give no guarantees that you aren’t going to lose your money, your account, and your inventory. But of course there’s more to it. Cheats kill interest in the game in both the honest players and those that use them.
Any achievements become worthless; once you’re Global Elite, there’s no point in ever logging onto the game again. There’s nothing left to play for: if you want more out of the game, you’ll need to turn off the cheats. And without them, you won’t be as awesome. Money can’t buy a true victory — or the emotions after each round you’ve played fairly and won.