CafeBlock - Significantly reduce the amount of cheaters on your server.

voogru · **Author**

This is the first plug-in I have released in several years.

A while ago, I discovered the potential Steam cafe ID ranges, at one point in my server programming I developed an automatic "speed hack" detection script that would record demos and flag speed hackers making them become useless on the server. After implementing this script, my server recorded usually anywhere from 2 – 6 speed hacker demos a day, I had so many cheaters that I started YouTubing some of them.

Since I keep everything on every player in a database, I discovered a pattern with most of the people caught cheating, their steam id’s were in a particular range of ID’s, I suspected these absolutely must have been café accounts because I’d have the guy with the same name come on my servers repeatedly with similar Steam ID’s.

My database of players, records every steam id of every player who comes onto my server, their IP address, and other various pieces of information I am able to obtain about them, I also keep track of how many times players connect to my server, and this is tied to their Steam ID.

I went ahead and calculated possible steam café ID ranges and queried them against my player database, to my surprise, out of over 130,000 records at the time, going through a range of 100,000 ID’s returned roughly 1,600 Steam ID’s.

Out of roughly 1,600 ID’s, 98% of them connected only 1 time, none of them connected more than 5 times except for 1 player, who was a regular. Also, Nearly every one of the cheaters that have been caught on my server were in this range of ID’s

Figuring that I had the Steam ID café range down pat, I implemented a block on all 100,000 ID’s, excluding the one regular (okay, so 99,999) ID’s, I have been running this block for months.

Here’s the result:

* Automatic cheater videos have dropped from 2 to 6 demos a day, to less than 1 a month, there have been just 2 cheater demos since I have implemented the café block. And one of them was a false positive (false positive just recorded a demo, the player was not flagged as a cheater).

* Amount of cheater complaints on my forums have become near non-existent.
* Amount of “suspect” players have fallen off a cliff.
* Server not being emptied due to no admins on and blatant cheater causing everyone to leave.

My suspicion for this massive drop in cheaters on my server, is simply because:

* Most cheaters in TF2, pay for cheats. There are no public TF2 cheats as far as I know. In order to test some counter-measures, I had to actually get an old cheat and update it and make it work in TF2.
* Most cheaters in TF2 that pay for cheats, also buy access to a ‘shared’ steam café account, because the VAC immunity of these accounts is well known, and abused.

The reason for the VAC Immunity on steam accounts is fine and dandy, it is there to protect the steam café account owner from a café user installing cheats and getting his café account VAC banned.

The problem is, you do not have to be running an internet café to get café accounts. Valve needs to ensure only café owners actually run café accounts, until then, cheaters can simply bypass VAC by using a café account.

I struggled whether I should release this plug-in or not, if enough server operators install it, it will hurt legitimate cafés, but I see every day cheaters having a field day on other servers and other server admins having problems, and valve knows about the abuse, but it does not seem that they have put forth the effort to resolve it at least within a reasonable timeframe, I am a reasonable person and I’m sure they will resolve it, but until then server operators should be able to do something.

Now, onto the plug-in goodies.

This plug-in will block, what I suspect to be the Steam Café ID range, which is 100,000 ID’s wide, my 3 servers receive roughly 10-20 connections a day with players in this ID range, out of 4,000+ connections a day, your results may vary.

This plug-in will not prevent a cheater who is using a standard steam account, and it’s possible for there to be steam café accounts that are not in the range, I only have a suspected range, I am not absolutely sure, but I am going by what my gut is telling me.

In the event that you have a false positive, or a regular that has an ID falling in the range, you can white list ID’s. I will also in the future implement white listing of IP addresses, and a possible change to the disconnect message instructing the user to have the café owner contact the admin for the server, to white list the cafés IP address, any legitimate steam café will have a business internet account with a static IP anyway.

Anyways, onto the plug-in details.

Plug-in commands:

cb_whitelist = This command will show all white listed Steam ID’s
cb_whitelist_add = This command adds a Steam ID to the white list.

Take note that the SteamID You pass to it, must be enclosed in quotes.

E.g.
cb_whitelist_add “STEAM_0:0:1234”

cb_whitelist_remove = This command removes a Steam ID to the white list.

Take note that the SteamID You pass to it, must be enclosed in quotes.

E.g.
cb_whitelist_remove “STEAM_0:0:1234”

White listed ID’s are stored in “addons\cafeblock\cb_whitelist.db”

Link to plug-in I hope it's okay to post this as a link to the thread on my forum.

Currently, this plug-in is Orange Box, Windows Only. I will have a Linux version for Orange Box in the next few days, I do not currently intend to make this work on engines older then orange box, but if enough people ask, I will.

The plug-in will output log events when a connection is denied, they will look like this:

Code:

L 05/24/2008 - 04:11:48: [CAFEBLOCK] Connection refused from potential cybercafe account <Angry Kid> <STEAM_0:1:7573852> <212.27.199.149:27005>
L 05/24/2008 - 16:26:10: [CAFEBLOCK] Connection refused from potential cybercafe account <n1> <STEAM_0:1:7752913> <70.164.109.136:27005>
L 05/25/2008 - 14:26:50: [CAFEBLOCK] Connection refused from potential cybercafe account <valdis> <STEAM_0:1:7757228> <67.151.194.190:9222>
L 05/25/2008 - 19:39:41: [CAFEBLOCK] Connection refused from potential cybercafe account <Violent System.> <STEAM_0:1:7753545> <24.215.17.21:27005>
L 05/26/2008 - 08:41:17: [CAFEBLOCK] Connection refused from potential cybercafe account <{CD} Snaxib> <STEAM_0:1:7573493> <207.236.25.196:27005>
L 05/26/2008 - 22:27:39: [CAFEBLOCK] Connection refused from potential cybercafe account <ROME> <STEAM_0:1:7757044> <70.125.96.223:27005>
L 05/27/2008 - 11:57:59: [CAFEBLOCK] Connection refused from potential cybercafe account <-==))blaster((==-> <STEAM_0:1:7755526> <82.225.175.60:27005>
L 05/27/2008 - 21:31:53: [CAFEBLOCK] Connection refused from potential cybercafe account <Leave Stalker Alone> <STEAM_0:1:7751822> <82.247.150.45:27005>
L 05/27/2008 - 23:17:41: [CAFEBLOCK] Connection refused from potential cybercafe account <dprest68 (R.o.B)> <STEAM_0:0:7552510> <65.33.96.210:27005>
L 05/29/2008 - 00:38:00: [CAFEBLOCK] Connection refused from potential cybercafe account <Insanity! iNfusion *WEBGAME> <STEAM_0:1:7767733> <79.181.9.176:36139>
L 05/29/2008 - 00:38:14: [CAFEBLOCK] Connection refused from potential cybercafe account <Insanity! iNfusion *WEBGAME> <STEAM_0:1:7767733> <79.181.9.176:36139>
L 05/29/2008 - 01:01:07: [CAFEBLOCK] Connection refused from potential cybercafe account <Insanity! iNfusion *WEBGAME> <STEAM_0:1:7767733> <79.181.9.176:36139>
L 05/29/2008 - 17:59:45: [CAFEBLOCK] Connection refused from potential cybercafe account <Veag> <STEAM_0:1:7755937> <67.193.46.176:27005>
L 05/30/2008 - 15:42:09: [CAFEBLOCK] Connection refused from potential cybercafe account <adren owns this> <STEAM_0:1:7752747> <70.51.9.64:62392>
L 05/31/2008 - 01:04:39: [CAFEBLOCK] Connection refused from potential cybercafe account <Deadguy> <STEAM_0:0:7764285> <209.124.255.228:43621>
L 06/02/2008 - 14:34:15: [CAFEBLOCK] Connection refused from potential cybercafe account <c0ldkilla> <STEAM_0:1:7760636> <70.171.69.155:1189>
L 06/02/2008 - 14:34:19: [CAFEBLOCK] Connection refused from potential cybercafe account <c0ldkilla> <STEAM_0:1:7760636> <70.171.69.155:1189>
L 06/02/2008 - 14:42:42: [CAFEBLOCK] Connection refused from potential cybercafe account <c0ldkilla> <STEAM_0:1:7760636> <70.171.69.155:1189>
L 06/02/2008 - 17:39:32: [CAFEBLOCK] Connection refused from potential cybercafe account <krafen> <STEAM_0:0:7773353> <70.69.176.13:27005>
L 06/03/2008 - 16:43:32: [CAFEBLOCK] Connection refused from potential cybercafe account <L7 adam> <STEAM_0:0:7569816> <69.112.159.224:43620>
L 06/03/2008 - 20:12:35: [CAFEBLOCK] Connection refused from potential cybercafe account <KeLs | SoopDoop> <STEAM_0:1:7750801> <74.165.227.252>
L 05/23/2008 - 20:47:13: [CAFEBLOCK] Connection refused from potential cybercafe account <Ace> <STEAM_0:0:7769620> <207.236.25.202:27005>
L 05/24/2008 - 03:08:57: [CAFEBLOCK] Connection refused from potential cybercafe account <My Little Pwnie> <STEAM_0:1:7752927> <24.111.12.50:25172>
L 05/24/2008 - 05:47:36: [CAFEBLOCK] Connection refused from potential cybercafe account <Jakid!|DK|> <STEAM_0:0:7558864> <77.213.21.71:13325>
L 05/24/2008 - 06:14:28: [CAFEBLOCK] Connection refused from potential cybercafe account <32> <STEAM_0:1:7760560> <76.10.173.173:27005>
L 05/24/2008 - 16:07:04: [CAFEBLOCK] Connection refused from potential cybercafe account <Woll Smoth> <STEAM_0:0:7772094> <69.33.140.241:27005>
L 05/25/2008 - 03:53:25: [CAFEBLOCK] Connection refused from potential cybercafe account <d0ufu> <STEAM_0:0:7562086> <70.79.158.249:27005>
L 05/25/2008 - 11:14:38: [CAFEBLOCK] Connection refused from potential cybercafe account <-[IBSC]-006> <STEAM_0:1:7558950> <75.118.170.90:27005>
L 05/25/2008 - 17:32:13: [CAFEBLOCK] Connection refused from potential cybercafe account <deathtroller> <STEAM_0:1:7760497> <65.183.35.50:27005>
L 05/25/2008 - 17:32:19: [CAFEBLOCK] Connection refused from potential cybercafe account <deathtroller> <STEAM_0:1:7760497> <65.183.35.50:27005>
L 05/26/2008 - 18:13:30: [CAFEBLOCK] Connection refused from potential cybercafe account <Insanity Prawn Boy> <STEAM_0:0:7762911> <68.124.113.198:21059>
L 05/27/2008 - 15:14:29: [CAFEBLOCK] Connection refused from potential cybercafe account <Veag> <STEAM_0:1:7755937> <67.193.46.176:27005>
L 05/28/2008 - 07:39:54: [CAFEBLOCK] Connection refused from potential cybercafe account <Gabe> <STEAM_0:0:7773578> <77.204.92.79:27005>
L 05/29/2008 - 08:46:06: [CAFEBLOCK] Connection refused from potential cybercafe account <|DSE| zxcv> <STEAM_0:1:7771365> <213.51.227.15:62601>
L 05/29/2008 - 08:46:18: [CAFEBLOCK] Connection refused from potential cybercafe account <|DSE| zxcv> <STEAM_0:1:7771365> <213.51.227.15:62601>
L 05/31/2008 - 04:50:56: [CAFEBLOCK] Connection refused from potential cybercafe account <_┌⌐┼ª!xxK╪ú┼ï─ƒ*> <STEAM_0:1:7755955> <81.165.253.235:27005>
L 05/31/2008 - 04:52:45: [CAFEBLOCK] Connection refused from potential cybercafe account <_┌⌐┼ª!xxK╪ú┼ï─ƒ*> <STEAM_0:1:7755955> <81.165.253.235:27005>
L 05/31/2008 - 13:56:46: [CAFEBLOCK] Connection refused from potential cybercafe account <Dunn> <STEAM_0:1:7761620> <75.147.219.134:53918>
L 06/03/2008 - 00:24:56: [CAFEBLOCK] Connection refused from potential cybercafe account <╞ªß┤æß┤æ╤Å> <STEAM_0:1:7769454> <12.46.91.204:27005>
L 06/04/2008 - 22:52:36: [CAFEBLOCK] Connection refused from potential cybercafe account <[jakd.up] Davy Jones> <STEAM_0:1:7768585> <69.224.40.13>
L 05/24/2008 - 14:31:11: [CAFEBLOCK] Connection refused from potential cybercafe account <Dentrag> <STEAM_0:1:7756811> <82.247.150.45:27005>
L 05/24/2008 - 16:12:12: [CAFEBLOCK] Connection refused from potential cybercafe account <RonindeBeatrice> <STEAM_0:0:7764803> <98.166.5.159:27005>
L 05/24/2008 - 16:25:45: [CAFEBLOCK] Connection refused from potential cybercafe account <I'm An E-Pedo k?> <STEAM_0:1:7753054> <68.107.209.209:61135>
L 05/25/2008 - 14:08:23: [CAFEBLOCK] Connection refused from potential cybercafe account <Flaming Ashmedi> <STEAM_0:0:7773966> <130.70.82.147:27005>
L 05/25/2008 - 14:08:27: [CAFEBLOCK] Connection refused from potential cybercafe account <Lord of Entropy> <STEAM_0:0:7773998> <130.70.82.146:27005>
L 05/25/2008 - 14:08:29: [CAFEBLOCK] Connection refused from potential cybercafe account <Flaming Ashmedi> <STEAM_0:0:7773966> <130.70.82.147:27005>
L 05/25/2008 - 15:29:06: [CAFEBLOCK] Connection refused from potential cybercafe account <Lord of Entropy> <STEAM_0:0:7773998> <130.70.82.146:27005>
L 05/25/2008 - 20:48:39: [CAFEBLOCK] Connection refused from potential cybercafe account <[DI] Crizomatic> <STEAM_0:0:7571605> <76.253.166.161:27005>
L 05/28/2008 - 07:39:36: [CAFEBLOCK] Connection refused from potential cybercafe account <Gabe> <STEAM_0:0:7773578> <77.204.92.79:27005>
L 05/31/2008 - 13:19:09: [CAFEBLOCK] Connection refused from potential cybercafe account <asdafd> <STEAM_0:1:7752693> <74.93.227.109:27005>
L 05/31/2008 - 13:55:55: [CAFEBLOCK] Connection refused from potential cybercafe account <Wasp> <STEAM_0:1:7757196> <81.243.245.45:64673>
L 05/31/2008 - 19:59:07: [CAFEBLOCK] Connection refused from potential cybercafe account <IMT> <STEAM_0:0:7771466> <70.51.9.64:62010>
L 05/31/2008 - 20:38:46: [CAFEBLOCK] Connection refused from potential cybercafe account <BIG_MIKE_=STEELSEEKER> <STEAM_0:0:7773245> <75.147.219.134:53944>
L 05/31/2008 - 20:39:08: [CAFEBLOCK] Connection refused from potential cybercafe account <BIG_MIKE_=STEELSEEKER> <STEAM_0:0:7773245> <75.147.219.134:53944>
L 06/01/2008 - 16:01:26: [CAFEBLOCK] Connection refused from potential cybercafe account <BIC Lighter> <STEAM_0:1:7573034> <65.183.35.50:27005>
L 06/03/2008 - 04:53:24: [CAFEBLOCK] Connection refused from potential cybercafe account <Mayragorilas> <STEAM_0:1:7752280> <12.182.90.132:27005>
L 06/03/2008 - 07:02:37: [CAFEBLOCK] Connection refused from potential cybercafe account <simonsen> <STEAM_0:0:7774660> <213.134.160.232:27005>
L 06/05/2008 - 17:12:42: [CAFEBLOCK] Connection refused from potential cybercafe account <knobjockey does tf2> <STEAM_0:1:7751009> <24.155.184.76>

voogru · *Last edited by voogru; 06-14-2008 at 03:18.*

I performed a quick google search on this particular player:

L 06/05/2008 - 17:12:42: [CAFEBLOCK] Connection refused from potential cybercafe account <knobjockey does tf2> <STEAM_0:1:7751009> <24.155.184.76>

http://www.livevideo.com/knobjockey123

Electric Warrior

Excellent idea and plugin Voogru, just a shame it doesn't support the engine for HL2DM.

I hope enough of us admins of such servers will pop up and prompt you to release a version for them.

Meantime, thanks for your work.

voogru

Quote:

Originally Posted by Electric Warrior

Excellent idea and plugin Voogru, just a shame it doesn't support the engine for HL2DM.

I hope enough of us admins of such servers will pop up and prompt you to release a version for them.

Meantime, thanks for your work.

I want to see how much interest there is for this plug-in, if it becomes widespread enough, I might just start up a website to authenticate legitimate cafes, and white list their static IP's.

And then modify the plug-in to fetch the IP list every time it's loaded or map change.

Xp3r7

This is a great idea. Our forums are always full of hacking reports too, so maybe if we give this a try, they will slim down or stop as yours did.

sirmoe

all cafe ids are 7 digit as far as i know, could you add some sort of rule that the cafe ranges only apply to 7 digit IDs?

INsane_dod

Well done, please consider making one for linux and other engines as well, what happens is they will drift on to servers that don't have a cafe ban system... reduces for some servers... increases for others.

Pity Valve does not act on this, gives weak minded little boys a tool to annoy people.

voogru

Quote:

Originally Posted by sirmoe

all cafe ids are 7 digit as far as i know, could you add some sort of rule that the cafe ranges only apply to 7 digit IDs?

Yeah but not all ID's with 7 digits are cafe accounts.

Quote:

Originally Posted by INsane_dod

Well done, please consider making one for linux and other engines as well, what happens is they will drift on to servers that don't have a cafe ban system... reduces for some servers... increases for others.

Pity Valve does not act on this, gives weak minded little boys a tool to annoy people.

I will have an Orangebox linux version soon, and if enough people request a version for the older HL2 engine I'll support that as well. I really want to see how much interest there is in this.

Cooltad · *Last edited by Cooltad; 06-16-2008 at 21:32.*

You should make it so I can put this addon in the metamod folder, it crashes if its anywhere other than addons folder.

voogru

Quote:

Originally Posted by Cooltad

You should make it so I can put this addon in the metamod folder, it crashes if its anywhere other than addons folder.

Hmm.. that's wierd, the only thing that should happen if you don't use it in it's own dir is that the whitelist won't work, I'll look into it.

You should be able to make a "cafeblock" folder inside of addons\ and have the binary whereever you want (and the whitelist will still work).