SpeedHacking Torque for fun and profit.

#1 If you get a trojan warning from AV software, it is the keyboard hooker.
If you are interested in testing this and are afraid, possibly try a commercial app like Speed Gear from Downloads.com.

#2 Not sure why you think this works in a multiplayer Torque game?

#3 All you've done here Ari is help others cheat and publicize your game.

Way to go.

#4

Quote:All you've done here Ari is help others cheat and publicize your game.

A) If he was making publicity for his game, he would've posted a link
B) This is a private developer forum, not a public gamer forum. So he's not helping others to cheat.

#5

Quote:In Minions of Mirth I used it until they removed RvR.

Hey! You hacker!!!

We haven't removed RvR.. although the server does double as our testing server. The next patch features dynamic PvE, PvP, and RvR which players can choose from on all servers :)

MMORPG generally trust the client way more than your average 2-32 player deathmatch/CTF systems... at least in terms of "simulation". That's why it's possible to hack things like teleportation in WoW from client side.

#6

Quote:
This is a private developer forum, not a public gamer forum. So he's not helping others to cheat.

True, but there's also quite a bit of misinformation up there. For instance, he does not go to any lenght explaining how you would speedhack a Torque multiplayer game.

The original Halflife and Starwars Galaxies had client side code which calculated movement and the server only did periodic checks to make sure they didn't move too far. This is more performant but also prone to cheats, which is why they patched it when the exploit became known.

Torque does not, to my knowledge, employ such methods anywhere on the client and thus I call his statements false. The client does movement prediction, which is not authorative and just a way to minimize the effects of latency. He's probably trying to cause some havoc without really knowing what he's talking about, no offence.

#7 Yeah I was gonna say I have not seen this cheat work in torque multi player (client/server configuration).
and having worked on games before and fixed it, its actually pretty easy to fix (generally).

of course if your trusting the client (one of the number 1 no-no's in multiplayer and MMO games)
then you made your bed your gonna have to lay down in it.

and sure often times its less work to trust the client, can offload a bunch of gameserver processing and such, but its the dark side and once you go down that path its all over, with so many eyeballs looking at a game (great example WoW) there isnt anything you can get away with that those players wont figure out eventually.

so you have to have server side authentication for everything. and generally plain vanilla torque actually already does a good job.

maybe in this case he is referring to just running the client/server on the same machine? instead of running a remote server connecting to it from another client and then trying the speed hack.

torque does a lot of server side checking so id be surprised if over the years they broke it since it use to be immune to this type of cheat.

#8 Thanks for the info... my client *is* trusted quite a bit more than a normal MODable FPS game because I figured I could encrypt the scripts and not have to worry about it too much.

I'll download this and ensure that it can't be used as a cheat.

I could see how it would, though... client-side timers are used for several things, including health / mana regeneration and spell cool-down times.... looks like I might have to move these back to the server.

#9 My only comment is that the original poster specifically states he used it with Minions of Mirth, which afaik is a multiplayer (only) game. If he was able to cheat with it there, then it is not just a local client/server setup, but works for remote servers as well.

I can't comment on whether these cheats actually work or not, nor would I have any idea how to prevent against their use. I'm new to this engine, and as such, very inexperienced.

I should also add that

Quote:MMORPG generally trust the client way more than your average 2-32 player deathmatch/CTF systems... at least in terms of "simulation". That's why it's possible to hack things like teleportation in WoW from client side.

The original poster (as well as myself) are developing MMO games using third party code (www.mydreamrpg.com). Whether or not that code made significant changes to the way network traffic is handled, I do not know.

Mike

#10 Two things:

1) He is correct in that programs like this are used by cheaters daily for many games. I personally see it happen in Everquest very often

2) Torque uses a move credit system which, by stock, should severely limit the effectiveness of packet mash based hacks (sending an incredible amount of packets to the server in an attempt to give yourself extra moves). Please describe what facets you've tested with Torque (stock best, Tribes ok) that give you an in game advantage.

Personally and professionally, I think this is a great topic to dicuss. A lot of Torque systems are designed from the bottom up to be network based, and to reduce the amount of effective cheating possible in multi-player scenarios, but nothing is perfect and new cheating tactics come out often. Let's just keep it professional and informative please.

Quote:
I have asked for help with this in the past and never received any answers or found a solution.
Apologies for airing the dirty laundry but it has to be done.

Uhh, where and when? This is a topic of particular interest to me (I have a network security background), and I have never seen a professional discussion on the topic to the best of my recollection.

#11

Quote:
Uhh, where and when? This is a topic of particular interest to me

I agree. I think this is a very interesting topic and I find it odd that the OP mentions it has been up for discussion before but with no response.

#12 @Stephen and Stefen: Ask Paul Dana and a few others but I remember asking Paul specifically while he was at GG headquarters in Oregon awhile back. I wanted to keep it quite and only alert GG. I've been around this community long enough, you guys should have seen a post from me on nearly every resource. I'm no stranger here. But I do understand that this is a troublesome topic (that's why I'm posting). Also, I too have a background in network security from the gambling industry and currently I am an administrator for a broadband ISP. I suggest lab testing this threat to harden your product as I am doing.

@Josh: Thanks for not breaking my balls over this, it's purely constructive. Name dropping MoM was only to demonstrate a vulnerable game that we all know. If you ask some of your GMs most likely they have seen me doing this. Glad to hear RvR is back. I may have to come demonstrate this AGAIN. :/

I find it interesting that it is even discussed whether this works or not.
Many MoM players have seen me doing this on the remote servers.
I have included multiple links/programs for testing.
This is a private Torque owner forum, so all of you have Torque (or develop the head) and can test in multiplayer over a network yourself.
This thread was not designed as a hoax or for someone to call me a liar.
It was designed to find a solution.
I guess I can go on MoM or Tribes 2 (maybe Shelled, Lore, Marble Blast??) and record fraps videos and possibly a discussion with a GM that I notify to sell any non believers.
I have more important issues at hand (like securing my product from cheaters) but I may post videos if it helps expedite my request for help.
If you have not tried or do not understand this please do not make this a "theoritcal" thread (like what DB is best for an MMO when you have not even tested).
Please treat this subject with respect.

Ari (3+ year Torque based developer - Ruin Online)
http://www.brokeassgames.com

#13 This isn't a 'touchy' subject--simply an important one.

You still haven't told us anything at all about what you are doing.

Videos don't do a thing. Tell us what the program does, how you use it, and what the game effects are.

Quote:
If you have not tried or do not understand this please do not make this a "theoritcal" thread (like what DB is best for an MMO when you have not even tested).
Please treat this subject with respect.

Currently, you are the one giving theoreticals and not facts :) I agree, and have said multiple times, it's an important subject, so give the information you are hinting at so we can discuss it.

#14 I know how you would move more quickly with this hack... though, health regen, spell casting, combat, etc is all handled on the server. If you really want to cheat, just play single player and then we won't have to ban you :)

#15 Give us something constructive, no one cares what your background is if you can't prove you are right.

Edit: And I would be very interested in a solution if you're right. But right now all we have is alot of talk and nothing to show for it. Torque does not employ the same techniques as MoM, HL2, WoW and SWG does.

#16

Quote:Currently, you are the one giving theoreticals and not facts :) I agree, and have said multiple times, it's an important subject, so give the information you are hinting at so we can discuss it.

Quote:You still haven't told us anything at all about what you are doing.

Videos don't do a thing. Tell us what the program does, how you use it, and what the game effects are.

I thought I was fairly clear:

Quote:SpeedHackNT (and others) are programs that speed up an application's running speed.
In a client/server environment this can do numerous odd things.
In StarWars Galaxies I used this for nearly a year before they patched it (running faster, healing quicker, attacking faster and just straight pwning ebay twink jedi faces).

Quote:Run speedhack, select the application to hack and press + for faster - for slower during play.

Try one of the download links or Google speedhacknt or speedhack.

Quote:If you have not tried or do not understand this please do not make this a "theoritcal" thread (like what DB is best for an MMO when you have not even tested).
Please treat this subject with respect.

Thanks alot man.

#17 @Stefan: If you actually put down the Hatoraid and try this you will see it works.
I have provided working links, you are the one that is all talk.
I expected more help and less griefing.

@Josh: Exactly. :)

Edit: Nah, nm, I knew I'd get griefed for this.

#18 Okay so you are being griefed because people do not believe you? Good defination of griefing. People are asking you for some information on how this would be possible considering that it is not handled on the client, and then you go all offensive when you're the one who needs to prove something. That's why I usually try to avoid talking to you (remember the DB thread, same thing there. You know everything there is to know and if anyone else disagrees, then *they* are asked to prove it and not you who made the statement?).

The client predicts moves by executing them before they are handled by the server, but it is still not authorative of those moves and will be corrected. If it refuses to be corrected or if it runs a faster simulation, it will just be out of sync. That has nothing to do with network security, but the implementation.

I hope this discussion will turn into something useful, but right now it just reminds me of the DB thread.

Edit: And actually, I'll try those tools. Thanks for the links.

#19 Well I think we can all agree that we've seen people use various hacks in various games over the years. I know I have. From aim hacks in FPS games to speed/mana/health hacks in MMO games, to fire rate, money, and various other hacks in both genres. The simple fact is that cheaters are out there.

Whether the tools in the OP's post work or not, I think we can all agree that no system is completely bulletproof and somebody will always find a way to circumvent any security measures we provide. I think his point was to illustrate this fact, and ask for assistance in finding and plugging the holes, making everyone's online gaming experience more secure.

Now, I personally have not tested these tools yet, but I have no reason to believe they will not work as he says they have, because I've seen them in action in other games. Furthermore, I am not skilled or familiar with the engine enough to be able to pinpoint the security holes or risks, let alone fix them.

All I'm saying here is let's not let this get into a flame war. Rather than attacking each other, let's find and attack the flaws in the system. Keep in mind nobody is attacking the engine here, just wanting to improve on it.

Mike

#20 I tried the tools and they do not work, just as has been said all along.

On the cheating clients screen
Appears to be running very fast.
Teleports back now and then.
Lag icon is shown.
Other players jitter.

On non-cheating clients
The cheating player appears be running as fast as anyone else.