Valve Says Its Anti-cheat System Doesn't Spy on Users
Gabe Newell defends Valve's anti-cheat system on Reddit.
Valve Software bossman Gabe Newell recently jumped on Reddit to dispel rumors that the company is spying on Steam users through the anti-cheat system (VAC). A Counter-Strike: Global Offensive thread claims that Valve recently changed the way the VAC worked, allowing it to read all domains that the player visits and then send that info back to Valve's servers.
"We don't usually talk about VAC (our counter-hacking hacks), because it creates more opportunities for cheaters to attack the system (through writing code or social engineering)," Newell writes. "This time is going to be an exception."
Newell explains that cheat developers create DRM and anti-cheat code for their kernel-level cheats because they have a hard time getting money from players. These DRM-laced cheats "phone home" to a DRM server that confirms if the player has indeed purchased the cheat. VAC checks for the presence of these cheats.
"If they were detected VAC then checked to see which cheat DRM server was being contacted," Newell writes. "This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result."
He says that the whole cheat vs trust scenario is much like a cat and mouse game. The specific cheat and anti-cheat solution that brought on the recent spying rumor was effective for 13 days. The VAC's solution is now no longer active because the cheat providers have found a way around it: manipulating the DNS cache on the customers' client machines.
"Kernel-level cheats are expensive to create, and they are expensive to detect. Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain," Newell writes.
He says that VAC is "a scary-looking piece of software" because it is trying to be obscure, sneaky, and going after code that is trying to attack it. Thus, one way to get around this scary software and generate revenue is for cheat makers to jump on social sites and create a cloud of distrust. That means Reddit users will likely see more comments about the VAC system.
Newell goes on to state that Valve does not collect a user's browser history, Valve does not care about what porn sites the user visits, and Valve is not using the success of Steam to go evil. "You have to make the call if we are trustworthy. We try really hard to earn and keep your trust," Newell concludes.

Seriously though, if your cheating in an online game and worried about steam seeing the porn your browsing on the internet or whats in your DNS cache you should probably get out of the garage/attic/basement a bit more.
Google already knows everything your doing and you don't see the NSA/DHS knocking on your door for downloading midget clown bestiality pron...
"Who watches the watchmen?" /TinFoilHat.....
That is a delayed system in terms of months.
Cheaters learn, and adapt, they probably use separate accounts.
Those games are always dirt cheap, so you can make 5 accounts for the price of 1.
It does not function good in short or long term.
Active admins are most effective.
Oh really?
NSA Has Secret Agents Planted Inside World of Warcraft
Yes, granted, the possibility of a client of yours that isn't cheating who visits or contacts those servers is very, very low, but it's the principle that I'm questioning. Slippery slope*? Yep, I think so, especially when I stop and take a look at how rights have been steadily more and more eroded in the United States and elsewhere.
NOTE: I'm not comparing Valve to the NSA, I'm saying that if Valve continues to use a practice of restricting where their clients can go in order to use their software, what's to stop others from following their lead? Already I can't have e.g. SysInternal's ProcessExplorer running while playing certain games due to DRM, never mind the fact that it's my own machine and I should be able to run whatever I please on it because it's _MY_ machine.
*https://en.wikipedia.org/wiki/Slippery_slope
That is exceptionally narrowminded. Because you enjoy playing a game in a certain way, you assume that is the only way to play the game and have fun? I obviously do not agree with that assessment. Some people enjoy restoring cars, some enjoy racing them, some love modifying them and others enjoy just looking at them. All of those are legit reasons to be involved with cars.
The same should apply to electronic entertainment, and in this specific case gaming.
Besides, you imply that cheating ruins a game. Again this is incredibly narrowminded and suits only the simplest of minds. It CAN ruin a game, but it could also improve it. Cheating in Gnomoria makes the game more fun for example. Modding Flatout 2, and thus cheating, makes the game even better in multiplayer than it already was.
Thanks for your input ddpruitt. This is the part that I'm referring to:
I'll say it again: "Yes, granted, the possibility of a client of yours that isn't cheating who visits or contacts those servers is very, very low, but it's the principle that I'm questioning." If the VAC detects whatever it thinks is dodgy code, and then check the DNS cache and finds entries matching cheat servers, then I would imagine that the probability that the person is cheating is near 100%. Great. Nail the cheaters. They spoil it for everyone else.
Don't get me wrong, I'm not against not finding the people who ruin experiences for everyone else. It's the principle of forcing on your clients the restriction of what they can and can't do on the hardware /that they own and probably built themselves/ just so that they can run the software that they paid for that I'm questioning. Unless they change their purchase contract to "pay us x amount of money, don't run y programs and don't contact z servers and then we'll let you play our game" I think that's pretty dodgy.
Do we need ways of preventing people from ruining the online experiences of others? Yes.
Should we do that by taking away the freedom of use that people have over their own hardware? That's debatable, but in my opinion, no.
And for the record, I create non-free, propriety non-open source software as a job.