Monday, September 23, 2013

The extraordinary evidence that CCP tolerates botting

Poetic Stanziel wrote that CCP Sreegs, the head of security department left because he wasn't allowed to do his job and ban the bots because bots pay subscription too. This claim wasn't reinforced and was mostly ridiculed by the community. As Jester adequately put: "Let's just say that extraordinary claims require extraordinary evidence."

I've found it. Meet S (full name sent to CCP as a bot report). S is an ice miner. Similarly to half dozen of his identically fit buddies: pretty tanked Mackinaws. I gank miners recently and he was in a Mackinaw. He wasn't anywhere near ore or ice, neither his buddies. They were flying in the open space, thousands of kilometers from the nearest object. It's not surprising on its own: many players set their Mackinaws on orbit (moving protects from ganking) and when the ice disappears, the Mack flies in straight line. If he goes AFK (which isn't illegal) his ship will fly far from the original ice. Nothing interesting yet, I scanned them down and one by one they exploded. Since they were somewhat tanked, some survived in low hull. Nevermind, they were AFK, I came back 15 minutes later to finish the job. This was the fate of S too, I hit him and left him in hull:
However I already noticed something strange: he was 1500km from a station, flying directly away from its undock (you can see the station on the picture, it's the yellow thing between the wrecks). It seems someone undocked and left the computer. Strange. Why does someone leaves a mining barge with invulnerability field running flying away from a station?

Soon after he was left in hull, he warped off. "Damnit, he came back to the computer, I wasted a pair of catas for nothing" - I thought. I opened the scanner to find another target and noticed that the ice is up. I warped there, and look what the wind blew in:
Yup! Our buddy S went mining without repairing. While flying in a straight line can be done AFK, opening the scanner, finding the ice belt, warping there, mining, redocking when full cannot. If a player was around he would have noticed the missing armor and hull.

But maybe he was just very drunk and did not noticed. He somehow missed the destruction of 3 of his other Macks. So I continued with M, an identically fit (and later found to be identically implanted) Mackinaw. I stood on his face. I bumped him out of mining range. I warped Catalysts on him. I ganked him to hull. I invited him to duel, which he did not accept or decline. He just couldn't care less: reapproached the ice and continued mining until I put him out of his misery:

Let's continue with yet another member of the family, her name is also S. With her I recognized one more strange thing: she did not use drones. None of them did. Each and every one of them died with 10 light drones in the drone bay. Why did they have drones at all, I wonder. Maybe because the terrible homemade bot couldn't handle them? Well, having no drones is not a problem if you aren't alone in an ice belt which is usually the case. But when a big flashy ganker chased off everyone who are - you know - human players, the lack of drones introduces you to the true power. Literally:

The problem isn't the existence of bots in the game. There isn't a single MMO without bots. The problem is the horribly primitive nature of this bot:
  • There were half dozen of them, each behaving identically.
  • They were online all day (I did not attack them until I found less tanked targets).
  • They were flying into the nothing, doing nothing when there was no ice.
  • They instantly responded to the appearance of the ice anomaly.
  • They did not respond to convo, bumping, ganking, buddies dying, rats eating them.
  • They mined ice like a clockwork. No waiting time on the station, no idling on the ice field with full hold (no lasers), mined, filled, warped, returned.
I understand that it's not easy to catch a complicated bot that mimic human player well. I read the botting news on Nosy Gamer and see how botters cry for being caught despite leaving long pauses, being online only a few hours and so on. Also, the price of illicit RMT ISK isn't much lower than the official prices, so RMT botters, who probably use the best bots available cannot get enough ISK for their business. So CCP clearly can catch very sophisticated bots. How could they miss this obviously homemade, horribly primitive bot?

On purpose. The existence of this bot is the extraordinary evidence that CCP does not allow Team Security to ban bots. They are only allowed to catch RMT-ers, because they cut into the business of CCP. Someone buying ISK from an RMT site is not buying PLEX. But botting for yourself is tolerated, even if you do it in a very obvious and primitive fashion.

Why were the careful botters (who cry on botting forums) caught? Oh the irony: because they were careful. They used virtual machines and proxies to hide the connection between their bots and their main accounts. So Team Security couldn't determine if they are farming ISK for themselves or for sale, so they were banned as RMT suspects. Had they run their bots on their main accounts, they'd still be farming!



After the bad news that bots are free to devalue your income, let's see some good news, another constellation is cleansed from those pesky Mackinaws, Hulks, Covetors and untanked Rets:

25 comments:

mike dados said...

A good find, but you should tone down on the rhetoric a bit. It is not evidence. If you reported him and they still didn't ban him then maybe we should get worried. Many people that weren't rmting also got banned. Generalizing that all of them were using proxy is a very weak form of argument. There are many public examples where people using scripts / bots got banned without actually rmting, such as the guy that donated all his iskies to e-uni.

I always notice this in your articles, you have an interesting find and then you ruin it with outrageous claims and far fetched theories. I am not saying CCP is really doing its best, but saying otherwise based on this is also argumentatively insufficient.

Gevlon said...

Yes, if you report them, they get banned, because they annoy paying customers. But unless reported, they are ignored.

Again: the bot I've found is the most primitive bot theoretically possible that is able to function. If they fail to find it without player report, they are either not even trying, or the most incompetent developers on the planet.

Michael LeBlanc said...

"the bot I've found is the most primitive bot theoretically possible that is able to function. If they fail to find it without player report, they are either not even trying, or the most incompetent developers on the planet."

This seems to obviously be a bot, but only because you observe its behaviour. CCP doesn't watch everything all 500k accounts do. They need to have some trigger that causes them to look at an account. Player reports is one such trigger, from fanfest presentations we know that account to account transactions are another. Perhaps this bot just didn't hit any of their triggers yet.

From the look of it, it is probably a self-coded bot, so lots of detection techniques designed to catch popular bots would probably fail as well.

In any case, the existence of a single bot that seems obvious is in no way 'extraordinary evidence' that CCP is actively avoiding going after bots. At best it's mildly suggestive.

"Yes, if you report them, they get banned" Nice, you've managed to put your claim into unfalsifyable territory.

Gevlon said...

@Michael: how can a half dozen identical, 24/7 bots that do absolutely nothing (including basic self-defense), but ice mining fail to trigger alarms?

Can you imagine a player who does anything similar legitimately?

Anonymous said...

So CCP are just making up the bot bans when they release them?

Apart from that, as you know, because you researched before posting this, CCP ban in waves.

I trust that you reported this individual too?

NoizyGamer said...

Hi Gevlon,

This is a pretty funny story. But I think you missed the obvious explanation. Team Security doesn't really have a lot of resources.

The last time I looked the bot/rmt fighting team only consists of 4 people, and one of them is GM Grimmi. And CCP Stillman doesn't work on catching bots full time because he's doing other things like protecting our account information from hackers. Which, by the way, also helps fight the RMT trade. And I may have my priorities misplaced but I like having my account information protected.

So CCP has limited resources with which to fight the bots. That means they need to figure out how to get the most bang for their buck. So if its more efficient (i.e. costs less money) to set up a system that catches the big threats (i.e. Questor, H-Bot, etc) and leaves the amateur bots to for players to report, that's what's going to happen.

Now, don't get me wrong. I love botters getting banned. But I'm willing to be patient and as long as I can see steady improvement I'll be happy. Which is part of the reason you see me still watching what's going on with the War on Bots.

Anonymous said...

Do you know how difficult it is to find a 0.01 isk trade bot? Jita spam bots? Also very easy to detect.

I agree with your basic premise. CCP doesn't seem to mind botters. They respond to complaints and they actively try to catch the RMT botters. The rest of the bots are basically ignored.

Michael LeBlanc said...

"how can a half dozen identical, 24/7 bots that do absolutely nothing (including basic self-defense), but ice mining fail to trigger alarms?"

Multiple accounts doing the same thing are common. Miners not defending themselves against ganks is also common. Dying to rats less common, but that probably also doesn't happen to this bot very often either

The only red flag that would be picked up is the duration of activity, but you only know that he was on as long as your legitimate play session.

If I were designing a "bot detection trigger", I'm not sure it would pick this guy up just based on what you say. What programming parameters would you use to pick him up and not hundreds of non bots?

maxim said...

I don't know anything about internal workins of CCP's bot detection system. But i'm willing to be it doesn't involve automatic bans on suspect behavioir.

A suspect bot gets put on the list for a human being to review. There is also likely a priority system, putting more suspect bots above less suspect ones.

If that list is particularily long, and bots that are more suspect appear sufficiently often (i don't believe a single member of security team is able to process more than 8-10 bot suspects a day), then the lower priority bots may end up being unprocessed for a long time.

The big question here, however, is why CCP is not beefing up it's security department to catch all the bots. "Because they don't want to catch all the bots" is not a better or worse answer to this than anything else.

TLDR: sufficient evidence to claim that CCP is not banning the bots. Insufficient evidence to claim that CCP is actively forbidding its personnel to ban bots.

dobablo said...

How long was this bot active before you decided that CCP was deliberately ignoring them. Your arguement would be stronger if you could show that these bots had been active for a long time. A record of previously destroyed ships or character histories might help.

The only evidence you have shown is that a homebrew botter managed to run multiple bots for a couple of hours without getting banned. That does not count as exceptional.

Lucas Kell said...

While I don't doubt the existence of bots, I do question your reasoning:
"There were half dozen of them, each behaving identically." - So? ISBoxer will do this, and who doesn't use standard fits for all of their miners?
"They were online all day" - Not uncommon for ice miners. I was on all day yesterday on my high sec mining fleet while I worked.
"They were flying into the nothing, doing nothing when there was no ice." - Why would a bot do this? If you can automatically target, mine, dock, unload and undock, why would you need to sit in space? Sitting in station and undocking for the ice would make more sense.
"They instantly responded to the appearance of the ice anomaly." - Ice reappears EXACTLY 4 hours after it is popped. Most Ice belts will suddenly fill up with people every time they respawn.
"They did not respond to convo, bumping, ganking, buddies dying, rats eating them." - Not uncommon for an ISBoxer fleet. You'll often see them flying out in a pod too. Or like the other day, when a fleet run by a guy I was talking to in local turned up and one of his miners started launching missiles at a rock. He hadn't noticed until we did and told him. And it does not at all surprise me that some people do not respond to you.
"They mined ice like a clockwork. No waiting time on the station, no idling on the ice field with full hold (no lasers), mined, filled, warped, returned." - As does any efficient miner. When high sec mining, I know to the second when a cycle finishes, when my hold is filled, and when my orca is filled. Since an ISBoxer fleet needs you to control only one, you don;t even look at the others.
Bear in mind, if he's running a large ISBoxer fleet, he might not even be in the same system. You can easily set up 3 groups of miners in 3 different systems, all mining from just a single controlled client (which is why personally, I'm not a fan of ISBoxer being allowed).

All in all, this is down to your interpretation. Interpreting that you think they are bots, then using that to defame CCP claiming they allow bots is ludicrous.

Even if they are bots, the fact that CCP hasn't noticed doesn't mean a thing. There are thousands of miners acting exactly like this every day. Spotting that any group of them are bots is not an easy task, so saying things like "If they fail to find it without player report, they are either not even trying, or the most incompetent developers on the planet" shows total ignorance. It's not a case of going if(player.isActingLikeBot) Ban(player); It's a complex game, and it relies on players tripping triggers, then getting investigated. You flagged him so now he will be investigated.

If it does in fact turn out this guy was running a bot, congratulations! Because you helped him. You reported him as a bot, but you killed him, so CCP can't monitor his movements. Now all he needs to do is read here that you've reported him, and stop botting, and you've just helped a botter get away with it. Well done.

Anonymous said...

i don't see any evidence in your post that those guys are bots. Yeah they act stupid - might just be some guys playing from work not watching what they do. doh.

Its very unlikely that this is professional botter, because bots usually behave a lot better - for example its no problem for a bot to use drones, and its unlikely it would be wasting time through drifting.
Besides ice mining not being profitable enough to run bots on it. Even mining veldspar a bot would make more than from mining ice. Ice is mostly valuable to AFK-Miners.

As for the allegations of ccp not banning, and Sreegs leaving because of that: Bullshit. I talked to Sreegs a while ago and he has very good and private reasons to go back home.

Anonymous said...

I agree with noizygamer, Team Security is not only dealing with bots, and, while in an ideal world they would have a Blizzard sized security team (who, by the way, still mostly focus on account security and exploits), they are a small team, and as Noizy says, I would rather they focus on account security and actual exploits, rather than spending all day monitoring for any bot behaviour.

On a side note, this would probably not be a good time for me to mention that most of my mining and salvage ships are in hull, or at least in armor, because, yes, I undock and alt tab, and forget to hit warp, or, I have warped into an area and not turned on hardners etc and ended up in structure.
So yes, you will likely see me in the field in my mack well into armour, because, I keep forgetting to repair, because it is not important.

Anonymous said...

how can a half dozen identical, 24/7 bots that do absolutely nothing (including basic self-defense), but ice mining fail to trigger alarms?

The same way 24/7 afk cloakers fail to trigger alarms.
The same way 50 accounts in a fleet battle lock the same target hitting F1 at the same time fail to trigger alarms.
The same way Jita traders updating their orders every 5 minutes fail to trigger alarms.
The same way someone paying 1B ISK for an item you sell for 1M ISK fail to trigger RMT alarms.

You seem to be 105% sure about him beeing a bot - still you erase his name out of your screenshots. Why would you care? You are publishing names of ganked people all day long but protect the privacy of a botuser?
Maybe you know the differece between evidence and proof.
You have collected evidence, still you can't prove your conclusion.

As far as I know CCP does not use tools like "warden" which scan your PC (RAM, running processes) to find suspect programs.
What you are asking for is some kind of heuristic program able to watch, track, store AND interpret the behaviour of a player over a period of time.

Undocking and flying with active hardeners: could be afk, could be someone making an undock bookmark.
Warping to icebelt without repairing his ship: could be drunk
Not responding to bumping: best you can do
Not responding to duell invites while you are in an unarmed ship: let dumb players beg for it, ignoring it is the best you can do
Not responding to convos: du YOU accept every convo you receive?
Not launching drones: could be afk
Getting shot by NPC: could be afk

Every evidence on its own does not prove bot usage. It's the context that tells you. Making conclusions is something programs are very bad at.
I don't know programs which could do what you ask for, seem to be a lot of "most incompetent developers" out there...
If you can create such a "behaviour analysis program" you should tell NSA about it... bet they would be quite interestet, too.

Anonymous said...

> "I always notice this in your articles, you have an interesting find and then you ruin it with outrageous claims and far fetched theories."

> "Again: the bot I've found is the most primitive bot theoretically possible that is able to function. If they fail to find it without player report, they are either not even trying, or the most incompetent developers on the planet."

YES. one of the things that keeps me reading!

Ontopic. they need trigger to flag the botting account. without that the monitoring can't be activated for those accounts. Yes you can check for repetition but not everything gets loged. in your very example you will find that if you had some sort of extensive logging for all online icemining accounts that some percentage is equal to this bot but are REAL (very limited) people.

Sure you can auto flag any miner per default. still you will hit legitimate none-botting accounts. and that is very bad press too.

Anonymous said...

you were suprised by this? Their little youtube vids explaining the security features said they were focusing on RMT

I don't recall them saying they were going after bots, but saying they were going after RMT

Anonymous said...

I bet next week you will be outraged that CCP doesn't care about all the small-scale RMT ("Selling my account to alliance mate only for $300", "WTB Hearthstone beta key - 6b ISK", ...) that is prevalent in most medium-sized and large alliances...



tangurena said...

Another example of CCP knowing that certain players are bots - and refusing to ban or do anything with them - is to watch local in Jita, Amarr or any of the other trade hubs.

On weekends, Jita fills up. CCP has determined what the max load of the node can be before TiDi starts, so they block new players from entering Jita. CCP has explained on other occasions that the main server load for a node is boarding/unboarding a ship (this happens when docking, undocking, jumping, getting blown up). They've also stated that the scambots in local don't have a significant server load, so they leave them online. The implication is that CCP knows exactly who the bots are and that they DO NOT CARE. Any player that actually does get banned can legitimately accuse CCP of favoritism because they have shown clearly that some botting is "good" and some botting is "bad" and consistency is not something they feel bound by.

Anonymous said...

i once died to highsec rats. left the comp, didn't think about being docked or not, forgot to deploy drones, took my time in the bathroom, came back and wondered :)

sometimes i leave my ships floating in space and go to the supermarket, or pay a visit to friends.

a badly written bot is as uninteresting to me, and the game, as an isboxer, or anything else.

btw, i find spambots in jita much more annoying.

Anonymous said...

"They've also stated that the scambots in local don't have a significant server load, so they leave them online. The implication is that CCP knows exactly who the bots are and that they DO NOT CARE."

No, the implication is that they know how bots in Jita work (not who they are) and therefore they don't care for banning bots as a method to decrease server load.

CCP's answer was given in a context where players suggested that banning scambots could free up slots for players.

Original answers:
https://forums.eveonline.com/default.aspx?g=posts&t=245353&p=3

Anonymous said...

For about half a year, I multiboxed 10 Retrievers without any third party tools... and yes, I was accused of botting regularly.

* There were half dozen of them, each behaving identically.
* They were online all day (I did not attack them until I found less tanked targets).
* They were flying into the nothing, doing nothing when there was no ice.
* They instantly responded to the appearance of the ice anomaly.
* They mined ice like a clockwork. No waiting time on the station, no idling on the ice field with full hold (no lasers), mined, filled, warped, returned.

All that I did, too, resp. happened to me, too. As others have mentioned, you can predict when an ice field appears. So, yes, I've set an alarm for that.

* They did not respond to convo, bumping, ganking, buddies dying, rats eating them.

Well, that depends on the situation. But multiboxing 10 clients on one screen means, you overlap the windows so that you don't see anything happening. You only have the UI elements in reach you need. Overview showed only ice, no ships. I would notice dead ships only on my way back to the station. And so on.

So, where is your extraordinary proof?

helenakhan said...

One of the things I'd noted about the bots is insta-warping on being locked.

After a short period, they'd warp back to the belt to continue mining. Relock them, and off they'd go again. Repeatedly.

This is a case of context being proof. You could lock them from well out of scram or disruption range and the behavior was identical despite you being of no real threat.

If you want to disrupt bots (and it amuses you to do so), grab a ship with a good lock range and sit in the belt and use their own programming against them.

NoizyGamer said...

@Lucas Kell - I think you've picked up on a good point. In Guild Wars 2, ArenaNet basically banned all multi-boxing software like ISBoxer. The thinking I believe is, "what's the difference between a botter with 8 ranger bots and someone running ISBoxer running around with 8 rangers?" Functionally, from the videos I watched, none. So ArenaNet pulled the trigger and changed their policy.

If your wondering what the language would look like, you can follow the link.

Gevlon, I hope you don't mind if I leave a link with the language ArenaNet used.

https://forum-en.guildwars2.com/forum/support/account/Policy-3rd-Party-Programs-Multi-Boxing-Macros/first#post354869

NoizyGamer said...

After reading the comments, I just want to clarify something. I don't want CCP to ignore bots. RMT hurts all MMOs, not just EVE, and botting goes hand in hand with RMT.

I also don't want people to think I think botters who don't RMT are okay. Mission and ratting bots have the ability to seriously screw up the economy by opening up an ISK faucet that overwhelms the ISK sinks CCP has in place. In that regard I see no difference between the RMT botter and the guy botting for enough money to buy a cap or supercap. They both damage the in-game economy.

There's a bunch of other things wrong with botting, but I don't want to post a wall of text in Gevlon's comments.

Lei Merdeau said...

I think a bot would have noticed being shot. This smells more of ISBoxer.

Subscribe to the goblinish wisdom