Since the release of The Division last month, Ubisoft has been scrambling to stem the widespread use of hacks, cheats, and exploits that have ruined much of the PvP experience in the online-focused multiplayer shooter. But an analysis of client-side cheating programs by an experienced network gaming developer suggests the game may need a “complete rewrite” to fix major holes in its online security.
Glenn Fiedler is a game-networking consultant with credits on Sony’s God of War series, Respawn’s Titanfall, and more. In a detailed blog post this week, he lays out what he sees as a core problem of client-side trust in the way The Division’s basic networking is structured.
For his analysis, Fiedler makes reference to a recent hacking video (since set to private) that shows a client-side program modifying local memory locations to give a player infinite health, unlimited ammo, the ability to warp around the level and shoot through walls, and more. These kinds of demonstrations suggest to Fiedler that the game is using a trusted client network model, where the server essentially accepts the client-side reports of in-game events like player position, weapon fire rates, item inventory, and even when players are hit with bullets.
This is fundamentally different from how most multiplayer online shooters work, Fiedler explains. In games like Quake and Call of Duty, the server doesn’t simply trust reports of local gameplay information sent from the client machine (since those can be trivial to edit, especially on PC). Instead, in those games, the raw inputs from the client machine are replicated in what he calls “the real game” running on the server. That means that even if a player tinkers with the memory values on his own client-side copy of the game, that would only affect “ghosts” running on that local machine; the legitimate action being run on the server would be unaffected.
The Division’s apparent lack of this kind of basic network infrastructure isn’t exactly a new revelation; players have been calling attention to the game’s broken netcode and naive, client-side trust since the closed beta in January. “This is not just lack of anticheat, it is global networking architecture fuckup,” redditor Z000001 wrote at the time. “I highly doubt that this will be fixed any time soon after release. You probably might wanna stay away from PVP area while this problem is present.”
During that beta, Ubisoft said it was aware of “cheating issues in the Closed Beta on PC,” promising a solution by the game’s release on March 8. But despite that promise and a pre-launch patch that reportedly “extended server-side checks to detect any illegal actions from the game client, limit their impact in the game and track down the perpetrators,” client-side hacking is still reportedly rampant on the PC version of the game weeks after launch.
The reason for the continued problems, Fiedler suggests, is that fixing The Division probably isn’t just a matter of patching in a few simple server-side checks that test for those hacked clients. To be really secure, Fiedler says, the game would have to be reworked from top to bottom to run a complete, trusted version of the game on the server rather than simply using the game status data stored on individual client machines.
“I sincerely hope [this trusted client model] is not the case [in The Division], because if it is true, my opinion of can this be fixed is basically no,” he writes. “Not on PC. Not without a complete rewrite. … If a competitive FPS was networked [with a trusted client network model]… it’s really difficult for me to see how this could ever be made completely secure on PC.”
From a community management standpoint, Ubisoft has promised to “act a lot more strongly towards players who use exploits,” and a recent patch made it easier to report players suspected of running a hacked client. Person-by-person bans seem like a limited solution to deep technical problems that are being exploited by what seems to be an increasing number of players as time goes on, though. If this analysis is right, The Division may be stuck with its hacking problem for a while.