Mass Ban - Misunderstanding???????

[MrBastard]

They been sending non-unique system information (ie: no unique IDs), including your CPU & GPU related information such as basic model strings, in the RSA encrypted login packet ever since version 8.42 released in April 2009. The unencrypted GPU string added in 10.61 is merely a more detailed model string containing the full vendor and model names along with the supported OpenGL version, and just like the previous system information doesn't include any unique IDs and thus does't actually provide any more possibilities for detection than what was already possible with the data already gather since 8.42. Without any unique identifiers all they can do is create a system profile which at best only indicates the possibility of multi-clienting or ownership of multiple accounts but isn't absolute proof of either which is where they would have to look at other account data for more evidence.

Perhaps it's time though for a feature in bots and MCs to spoof this system information to a random or a specified configuration, if nothing else it would get rid of one point of possible evidence against you.

Thanks, did not know that. All i remember is seeing a post where someone pointed out his wireshark findings where the login pack sent had increased by 25% etc. Cant find it anymore

Maybe they are mass banning lately to free up space for more server mergers. Getting rid of so many servers must save a shitload of money, and if they get on steam a game full of botters dont seem appealing for new ones.

[nuub]

I will just post one single thing, nothing else.

If you bot, you WILL be banned, no matter what, someday you will get caught.

Craban, is this you o.0

[skurwysyn]

@skurwysyn could you provide a little more information, like.... did you use a different email for all of them? how different were the account names? did you create all the accounts in the same timeframe (within a range of 3 hours for example)?

Yes, my password and acc number were 100% different, i will give u example. acc numb : kronoss000 / pass : 921543zy, passwords and acc numbers, were not close to eachother. Emails were also 100% different . I created 3 emails on deautchalnd mail, 3 on usa mail, 3 on poland, and 3 on new zeland. Every email of each country was other( 3 different services). All accounts created within 5 hours. But i think cip dont look at creation date. From my point of view, they have written somewhere how many accounts are running from same adres ip. If its more than 3 they check and ban accounts. Thats only what i think.

[Apoc]

Craban, is this you o.0

ahahahahaha

[DarkstaR]

They been sending non-unique system information (ie: no unique IDs), including your CPU & GPU related information such as basic model strings, in the RSA encrypted login packet ever since version 8.42 released in April 2009. The unencrypted GPU string added in 10.61 is merely a more detailed model string containing the full vendor and model names along with the supported OpenGL version, and just like the previous system information doesn't include any unique IDs and thus does't actually provide any more possibilities for detection than what was already possible with the data already gather since 8.42. Without any unique identifiers all they can do is create a system profile which at best only indicates the possibility of multi-clienting or ownership of multiple accounts but isn't absolute proof of either which is where they would have to look at other account data for more evidence.

Perhaps it's time though for a feature in bots and MCs to spoof this system information to a random or a specified configuration, if nothing else it would get rid of one point of possible evidence against you.

In a recent update, they also began sending peak FPS and average FPS information to the server. This can be used for detecting FPS limiters, but I think it's just so they can get a performance metric on how terrible their client is.

As for spoofing configuration, I was considering it the other day. All possible strings are stored in clear-text in the binary, and can be easily extracted from each binary and sent at random. My worry there, though, is that sending so many different configurations to the server would be indicative of such a system. Moreover, the spoofer may have to make sure the data makes sense; What, for example if I say it's a PCIE3 card but a processor who socket is ancient, and not on any boards past PCIE1? Or can we assume Cip wouldn't try to detect this either?

[MrBastard]

If they also send FPS they can be almost absolute sure it is MC botting when it is on a large scale. They have IP, hardware, and they see that the avarge and peak FPS drop drasticly when more and more logon on that IP/hardware. Is it possible to tunnel each tibia client through a proxy so all got different IP?

[Sketchy]

In a recent update, they also began sending peak FPS and average FPS information to the server. This can be used for detecting FPS limiters, but I think it's just so they can get a performance metric on how terrible their client is.

Yeah I noticed your post about it on TP, I agree probably just performance metric which would be useful to have to help the development of a new client which they have said to be working on.

As for spoofing configuration, I was considering it the other day. All possible strings are stored in clear-text in the binary, and can be easily extracted from each binary and sent at random. My worry there, though, is that sending so many different configurations to the server would be indicative of such a system. Moreover, the spoofer may have to make sure the data makes sense; What, for example if I say it's a PCIE3 card but a processor who socket is ancient, and not on any boards past PCIE1? Or can we assume Cip wouldn't try to detect this either?

I didn't think of that worry about using many different configurations, probably because they would have to account for usage of proxy servers and multiple people legitimately playing from the same private network. So I'm not sure how likely it is they would look for that, at the very least you would definitely want to have an account stick to using just a single configuration. And yeah I would personally make sure the data makes sense with the chosen CPU & GPU models but I am a stickler for perfection with my own programming, I kinda doubt CIP would think to detect like this but you never know.

[DarkstaR]

I didn't think of that worry about using many different configurations, probably because they would have to account for usage of proxy servers and multiple people legitimately playing from the same private network.

My worry is not so much about so many configurations from the same network, but rather so many configurations tied to one account.