PSA: Cheat Awareness, Discussion, Notices & News

[-_JpK_-]

5 minutes ago, Generic_ said:

Even if I didn't do any

Hmm, well, I wouldn't worry about it unless it happens again.. Can't remember if there was any similar bonus lately.

 

[BrightSideOfTheSun]

10 hours ago, shelby-eleanor said:

 

you can make a playlist and then it won't kick other players

 

This works, but likewise it still means that there's no way of playing consecutive jobs in public lobbies. Hopefully Rockstar is aware of this issue and is addressing/will address this issue.

[GeneralDee]

7 hours ago, Generic_ said:

Even if I didn't do any

Sometimes we get a bonus just for logging in within certain dates. Not sure but it may be the case.

[Matushka]

UPDATE:

Modders are back.

 

Got a guy spawning stuff on me and then blowing people up, but when they died it showed me as the guy who killed them.

[-_JpK_-]

One report spotted on /r/gtaonline:

 

Quote

I just went from lvl 15 to 35 within seconds + a bunch of notifications and money added, so can assume the game still isn't safe. Reported it to r*, hope they fix it fast

 

Ah sheet, here we go again..?

 

I've been playing way too many hours enjoying the almost cheater-free experience. Just one mass-kill event, one bounty, and one invite-everyone-to-apartment trick.

 

[DutchHasAPlan]

9 minutes ago, -_JpK_- said:

One report spotted on /r/gtaonline:

 

 

Ah sheet, here we go again..?

 

I've been playing way too many hours enjoying the almost cheater-free experience. Just one mass-kill event, one bounty, and one invite-everyone-to-apartment trick.

 

 

This isn't the same thing - That's dropping collectible statues on other players which has been a thing since they came out. They give small amounts of Cash and some RP when picked up.

[-_JpK_-]

31 minutes ago, DutchHasAPlan said:

 

This isn't the same thing - That's dropping collectible statues on other players which has been a thing since they came out. They give small amounts of Cash and some RP when picked up.

 

Yes, seems confirmed.

 

[Frabbi 01]

2 hours ago, DutchHasAPlan said:

 

This isn't the same thing - That's dropping collectible statues on other players which has been a thing since they came out. They give small amounts of Cash and some RP when picked up.

This is the worst. Always keep your internet connection an arms length away! You will never see a hand pull a wireless usb out as fast as mine.

 

Had a friend who wasn't so lucky..... went up like 80 levels and got banned a few days later.

[gamerMK2]

Why those worthless idiots aka rockstar lawyers can't actually sue some mod maker for a change? Instead of sending pathetic threatening mails nobody afraid of anymore?

[Spider-Vice]

One issue that does need to be fixed due to the changes in their netcode - you get stuck in the clouds between jobs and the host needs to reinvite you via Social Club. I'm assuming the game is failing to make a connection to the other players in the job session due to the relay changes, or similar.

[BrightSideOfTheSun]

On 2/2/2023 at 7:28 AM, smurfynz said:

 

Tested on 2nd PC/Account and behaviour consistent.

Interestingly, loading a GTAV session then trying to go online via the pause menu>online reports the old "you must complete the prologue to unlock Online" chestnut.

Disable Firewall outbound rule gets the normal online menu instantly.

Will need to do some more testing to see whether only outbound needs to be opened up to actually get online.

Sorry for quoting a somewhat older post.

 

A friend is experiencing this issue at the moment. After the patch released they were able to play Online with no problems, but the next day they start to get this issue. No firewall rules are in place and Guardian isn't running. Tried restarting server/game/computer and no dice. They're able to access Social Club from web browser so it shouldn't be an IP ban.

 

Any suggestions on this problem?

[risefox]

Message spamming is not even fixed, not chat an sms that came through to your earhole coin sounds

[blk95ta]

They did at least finally fix whatever was locking me out of socialclub and online. 

[blk95ta]

13 hours ago, BrightSideOfTheSun said:

Sorry for quoting a somewhat older post.

 

A friend is experiencing this issue at the moment. After the patch released they were able to play Online with no problems, but the next day they start to get this issue. No firewall rules are in place and Guardian isn't running. Tried restarting server/game/computer and no dice. They're able to access Social Club from web browser so it shouldn't be an IP ban.

 

Any suggestions on this problem?

I believe R☆ servers mistakingly gave a bunch of xbox series s/x and ps5 players an IP ban for going into online from single player. It's a bug that makes the gane think they are using mod menus like PC players. Happened to me over 2 weeks ago. Was finally fixed yesterday. 

Edited February 4 by blk95ta

[BrightSideOfTheSun]

10 minutes ago, blk95ta said:

I believe R☆ servers mistakingly gace a bunch of xbox series s/x abd ps5 players an IP ban for going into online from single player. It's a bug that makes the gane think they are using mod menus like PC players. Happened to me over 2 weeks ago. Was finally fixed yesterday. 

Ah forgot to specify, we're on PC and not on Xbox/PS5

[krotex]

14 hours ago, gamerMK2 said:

Why those worthless idiots aka rockstar lawyers can't actually sue some mod maker for a change? Instead of sending pathetic threatening mails nobody afraid of anymore?

I'll tell you a terrible thing: Rockstar also pays to cheat makers for finding bugs and exploits.  

[Tez2]

Apart from what was stated in the patch notes, the good news are

- Establishing connections or the network handshake now fully goes through R* relay servers in all cases. Before the update, relay servers would be used in some cases where you can't directly connect to the host.

- Relay servers verify the P2P certificates preventing cheaters from spoofing RIDs.

- From what I've noticed, IPs of other players aren't leaked within the memory. I could be wrong ofc.

- Invite only lobbies are secure now as stated before.

 

The bad news

- No proper fix yet for affected corrupted accounts.

- While establishing the connection goes through relay servers, not all connections are routed through relay servers. Direct connections are still maintained revealing public IP Addresses.

 

Relay servers isn't a new concept. They have been used as far as 2015/2016. Interfering when a connection isn't able to be established directly. But are now used for establishing connections regardless.

 

IPs are, unfortunately, not "shielded" (Most IPs are shielded, but some are leaked) and mod menus are extra steps away from retrieving and showing IP Addresses.

 

Routing all traffic through relay servers may lead to an increase or a decrease in latency depending on how good the routing is. Valve, for example, claims their methods often results in a decrease in latency. But the backbone of Rockstar's network may not be as good as Valve and as such preferring to avoid increasing the latency of many players by doing so.

 

The new data protocol benefits Rockstar more in the everlasting battle of detecting cheaters and banning them. A new cloud service endpoint and server-side changes patched out spoofing. We need similar solutions to address how reporting cheaters leads to facing retaliation in the form of crashes and kicks. Plus, the report not being processed since the cheater has to allow the "Self Report" function to run on his client. All of them, of course, block it.

 

But if a report goes from a local client -> a cloud service -> the reported client, cheaters would at least know someone reported them, but not pinpoint exactly "who". This doesn't necessarily translate to reporting a cheater equals Rockstar banning him, since Rockstar has to verify all the data retrieved from the report and to avoid issuing out false positive bans. Some mod menu devs can be really good at spoofing the data to slip under Rockstar's radar. Even so, monitoring what the reported player does afterwards could solve the puzzle. A legit player wouldn't know he has been reported. A cheater, on the other hand, may fire back at all players knowing someone reported him, but unable to pinpoint exactly who. Easily giving the impression that he's cheating, but some cheaters may go the extra mile and not give off sus vibes right after being reported by not retaliating whatsoever. That, for our benefit, acts as a constraint for the cheater to act in good behavior.

Edited February 5 by Tez2

[Matushka]

Man, just if the reports went thru R* servers, all we need lol.

[Spider-Vice]

9 minutes ago, Tez2 said:

Valve, for example, claims their methods often results in a decrease in latency.

Refer back to my post where Valve has another actual FAQ of their own about it all including explaining all of it too. They don't claim it lowers latency necessarily in there, in fact their solution is also automatic depending on your connection - some ISP's have better routing (less latency) to the relays, others have better routes direct to the person. In the last case, Valve/Steam will *also* use direct connections and still reveal IP's. That is about as much as can be done in P2P, it can't be fully bulletproof, at best they could force relays to be used at all times, and even then...

 

On 2/2/2023 at 5:52 PM, Spider-Vice said:

Some more info on P2P relays and how Valve/Steam does it.

https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B71E

 

In Steam's case they have an user controllable toggle to always share your IP (less latency, less security), never share your IP (more latency, more security), or keep it Default (automatic, depends on connection quality). At the moment it's all mostly speculation as to how GTAO's new thing works, people are still looking into it as shown above by Tez's post and it shouldn't be taken 100% for gospel just yet, but Valve also seems to have some sort of auto mode for games that use Steam Networking too.

 

Most people with good connections, even if GTAO's solution is automatic, shouldn't have an issue tbh - GTAO isn't that latency sensitive anyway, 30ms vs. 60ms is probably not gonna be a game killer. There could be situations where the route from you, to the relay, then to the other person is actually BETTER than the direct route - will depend on the ISP (and that's going into a whole other rabbit hole in networking). I've had this happen with people I play games with across the pond.

 

I'm actually just glad to see relays as a whole finally being used in GTA Online.

[LaszloR1]

8 minutes ago, Tez2 said:

IPs are, unfortunately, not "shielded" and mod menus are extra steps away from retrieving and showing IP Addresses.

 

This is already happening. Menus are already showing the player's real ip next to the relay's.

Edited February 4 by LaszloR1

[Spider-Vice]

8 minutes ago, Tez2 said:

We need similar solutions to address how reporting cheaters leads to facing retaliation in the form of crashes and kicks. Plus, the report not being processed since the cheater has to allow the "Self Report" function to run on his client. All of them, of course, block it.

Yeah, it would be nice to see cheat reports actually work and go to a proper "unexploitable" endpoint, as I'm sure it would still help them scan for modders if those couldn't be intercepted.

[LastTiger]

On 2/2/2023 at 11:22 PM, Spider-Vice said:

In Steam's case they have an user controllable toggle to always share your IP (less latency, less security), never share your IP (more latency, more security), or keep it Default (automatic, depends on connection quality).

 

Do I bother changing it to 'never share' if I'm going to play GTA Online?

[Spider-Vice]

6 minutes ago, LastTiger said:

 

Do I bother changing it to 'never share' if I'm going to play GTA Online?

No this only affects games that use Steam Networking, doesn't work with games with proprietary networking like GTA. Just comparing it to Valve's own solution which is also similarly P2P/relay based.

[Paerindal]

There are still a lot of boost cheats in race activities.

Edited February 4 by Paerindal

[Tez2]

It didn't take long for mod menus to start looking for alternatives.

 

Spoiler

 

The good thing is that most players IPs are actually protected. Only a few players attempts to directly connect thus revealing their IPs. This goes back to what @Spider-Vice said in his post.

 

Spoiler

On 2/2/2023 at 8:52 PM, Spider-Vice said:

Some more info on P2P relays and how Valve/Steam does it.

https://help.steampowered.com/en/faqs/view/1433-AD20-F11D-B71E

 

In Steam's case they have an user controllable toggle to always share your IP (less latency, less security), never share your IP (more latency, more security), or keep it Default (automatic, depends on connection quality). At the moment it's all mostly speculation as to how GTAO's new thing works, people are still looking into it as shown above by Tez's post and it shouldn't be taken 100% for gospel just yet, but Valve also seems to have some sort of auto mode for games that use Steam Networking too.

 

Most people with good connections, even if GTAO's solution is automatic, shouldn't have an issue tbh - GTAO isn't that latency sensitive anyway, 30ms vs. 60ms is probably not gonna be a game killer. There could be situations where the route from you, to the relay, then to the other person is actually BETTER than the direct route - will depend on the ISP (and that's going into a whole other rabbit hole in networking). I've had this happen with people I play games with across the pond.

 

I'm actually just glad to see relays as a whole finally being used in GTA Online.

 

Prior to the patch, you could say GTAO was set on the "Always" option. The game establishes connections directly with other players, but relays the connection if a direct connection cannot be established.

 

But now, it's set on "Default" option. Establish connections via relay servers, but use direct connections whenever necessary to avoid excessive ping times. The "establishing" part is done via relay servers in order to verify the new P2P certificates.

 

Which brings us to a second point of locating where the relay servers are. Thanks to the various technical tests done by @logan-mcgee, we have a list of the region codes and the relay servers for each region.

 

Quote

Region 1 - Rockstar/Take-Two New York Server (South America/Africa)
Region 2 - Rockstar/Take-Two New York Server (Greenland/East Coast US)
Region 3 - Rockstar/Take-Two Amsterdam Server (Europe)
Region 4 - Microsoft Azure Hong Kong (Asia)
Region 5 - Microsoft Azure Sydney (Australia)
Region 6 - Rockstar/Take-Two New York Server (Canada/West Coast US)
Region 7 - Microsoft Azure Hong Kong (Japan)

 

More defined list from Logan:

Spoiler

RegionCode 1

Antigua and Barbuda, Reunion, Aruba, Barbados, Bolivia, Dominica, Ecuador, Falkland Islands, Grenada, Guadeloupe, Brazil, Argentina, Guyana, Ghana, Montserrat, Cameroon, South Africa, Kenya, Uganda, Burundi, Tanzania, Uruguay, Chile, Egypt, Paraguay, Peru, Malta, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Suriname, Swaziland, Trinidad and Tobago, Venezuela, Colombia, Angola, Benin, Botswana, Burkina Faso, Cape Verde, Central African Republic, Comoros, Chad, Equatorial Guinea, Democratic Republic of the Congo, Ivory Coast, Ethiopia, Eritrea, Gambia, Gabon, Lesotho, Liberia, Guinea-Bissau, Guinea, Madagascar, Libya, Malawi, Mauritania, Mali, Mauritius, Morocco, Mozambique, Namibia, Nigeria, Djibouti, Niger, Rwanda, Republic of the Congo, Sao Tome and Principe, Senegal, Sierra Leone, Somalia, Sudan, Togo, Tunisia, Zambia, Zimbabwe, Algeria, Seychelles, Saint Barthelemy, Martinique, Bonaire, Saint Eustatius and Saba , Curacao, South Sudan, Mayotte, French Guiana, Western Sahara

 

RegionCode 2

Bahamas, Bermuda, Cayman Islands, Cuba, Dominican Republic, Haiti, Honduras, Jamaica, Nicaragua, Panama, United States - Virginia, United States - New York, United States - New Jersey, British Virgin Islands, United States - Maryland, United States - North Carolina, Puerto Rico, United States - Florida, Costa Rica, United States - Connecticut, United States - Ohio, United States - Indiana, United States - Massachusetts, United States - Georgia, United States - Pennsylvania, United States - Rhode Island, United States - Michigan, United States - Tennessee, United States - Kentucky, Turks and Caicos Islands, United States - South Carolina, United States - Arkansas, United States - District of Columbia, United States - Delaware, United States - Maine, United States - New Hampshire, United States - Vermont, United States - West Virginia, Saint Pierre and Miquelon, Greenland, U.S. Virgin Islands

 

RegionCode 3

Serbia, Macedonia, Liechtenstein, Bosnia and Herzegovina, Jersey, Russia, Netherlands, Spain, France, Czech Republic, Austria, United Kingdom, Greece, Italy, Switzerland, Denmark, Germany, Portugal, Sweden, Poland, Belgium, Romania, Ireland, Norway, Luxembourg, Bulgaria, Finland, Ukraine, Moldova, Croatia, Vatican, Georgia, Slovakia, Estonia, Gibraltar, Latvia, Albania, Hungary, Lithuania, Andorra, Belarus, Faroe Islands, Monaco, Montenegro, San Marino, Svalbard and Jan Mayen, Aland Islands, Isle of Man, Guernsey, Kosovo

 

RegionCode 4

Laos, Oman, Lebanon, Syria, Azerbaijan, Kyrgyzstan, China, Thailand, India, Malaysia, South Korea, Singapore, Hong Kong, Taiwan, Cambodia, Philippines, Vietnam, Guam, Palestinian Territory, Turkey, United Arab Emirates, Jordan, Armenia, North Korea, Israel, Qatar, Iraq, Cyprus, Kazakhstan, Saudi Arabia, Iran, Bahrain, Indonesia, Bangladesh, Bhutan, Brunei, Cocos Islands, Christmas Island, Kuwait, Maldives, Macao, Mongolia, Myanmar, Nepal, Sri Lanka, Pakistan, Tajikistan, Turkmenistan, Uzbekistan, Yemen, Afghanistan, Northern Mariana Islands, British Indian Ocean Territory, East Timor, Palau, Micronesia

 

RegionCode 5

Norfolk Island, Australia, Fiji, Kiribati, Nauru, New Caledonia, Niue, Papua New Guinea, New Zealand, Solomon Islands, Tonga, Tuvalu, Vanuatu, Wallis and Futuna, Marshall Islands

 

RegionCode 6

Belize, El Salvador, Guatemala, United States - Texas, United States - Washington, Canada, United States - Illinois, United States - California, United States - Idaho, Mexico, United States - Oregon, United States - Missouri, United States - Colorado, United States - Alabama, United States - Minnesota, United States - Wisconsin, United States - Utah, United States - Kansas, United States - New Mexico, United States - Iowa, United States - Arizona, United States - Nevada, United States - Louisiana, United States - Hawaii, United States - Montana, United States - Nebraska, United States - North Dakota, United States - Oklahoma, United States - Alaska, United States - Mississippi, United States - South Dakota

 

RegionCode 7

Japan

 

You can summarize this as the Americas routing back to US East Coast (New York) or US West Coast (San Diego) as corrected by Spider. Europe routing to Amsterdam. Asia routing to Hong Kong. Australians routing to Sydney.

 

If you live where the relay servers are or near them, depending on your firewall, you can expect your IP Address to be shielded in most cases. If you don't, then your IP Address may still be shielded, but if the game notice that a direct connection is better off established with a player who lives nearby than a relay server miles away, your IP Address will be exposed to that nearby player. But if there's a second player who lives next to the "miles away" relay server, then your IP Address would be mostly likely shielded from him. I say "most likely" because it's a case of whose connection is more favorable in terms of firewalls.

 

Diving further turns the topic into a common issue experienced with most games. Routing and Server Availability across regions. In addition to Valve, Riot Games dives deep within their tech blog.

 

Spoiler

 

https://technology.riotgames.com/news/leveling-networking-multi-game-future

 

https://technology.riotgames.com/news/fixing-internet-real-time-applications-part-i

Riot Games went through lengthy contract negotiations with ISPs to establish the most optimal "Riot Direct" network which tries to snatch players from different ISPs into its own network to provide the best routing for a gaming experience. But GTAO most likely follows the traditional way of going through the routing of ISPs. Unfortunately, I doubt Rockstar would come up with their network since Take-Two would consider that a cost-prohibitive and time-consuming process.

 

Regardless, in my case, I only saw a few direct connections revealing their IPs out of a "more than 10 players" session where the majority were IP shielded. Would it have been better if all connections were fully IP shielded? Yes, but what we have in terms of a case-by-case basis is better than the previous state where all connections were exposing their IP Address.

Edited February 6 by Tez2

[Spider-Vice]

Slight correction, Take-Two does have servers in the West Coast, especially because of their other studios in that part of the US (corporate VPN's, other games' servers, etc.). A good way to verify that is by doing a traceroute to one of the relays used for players in California and notice how it makes its way to the West Coast of the US.

 

GeoIP databases can get kind of confused when it comes to large CDN's/corporations as it's not quite the same as GeoIP'ing a residential IP. In a traceroute of my own to one of the relay IP's for a player in California I get about 170ms from Western Europe, going through Salt Lake City, then assumingly to wherever they have the actual server (potentially San Jose, Sunnyvale, or even San Diego, or similar):

Spoiler

 

And now for one in New York. Notice the lower ping and the fact it goes to "EWR", which is the IATA code for New York City, which ISP's and network providers often use to identify regional backbones/servers:

Spoiler

 

192.81.245.* seems to be West Coast.

192.81.241.* seems to be East Coast.

 

When in doubt try tracerouting (either using specialised apps or the command line) the IP's because the route from your home to there will reveal more about its real location than GeoIP sometimes does.

 

As for the rest, I'd say bingo - that's it. It's basically what I said in my previous post about how Valve does it and it's good to see R* finally doing what most other P2P games do. Also surprised they actually got extra servers from Azure for some other regions of the world.

 

Other than forcing everyone to use relays and potentially causing major latency issues for a percentage of players, not much else they can do in the P2P world. Not 100% bulletproof, but something they should have done years ago IMO. Most players should have their IP's shielded especially the closer they live to some country capitals, and those with better ISP's. A good next step would be including an option like Steam/Valve do, to force yourself to use relays (at the expense of latency, desync, etc) at all times, or leave it automatic.

 

Regardless of when this should've been done, I'm personally pleased to see they did dig into this game's netcode enough to make meaningful changes, especially considering parts of it are ancient in comparison to games like RDR2.

Edited February 5 by Spider-Vice

[Spider-Vice]

44 minutes ago, Tez2 said:

If you live where the relay servers are or near them (...) you can expect your IP Address to be shielded in most cases.

It's also even a bit more complex than this, you can still be "far" from a relay server, but your route to Microsoft Azure or Take-Two (they seem to use Zayo) still can be better than the direct route to another player. But that's going into another massive rabbit hole in regards to ISP routes, which companies they've negotiated with, and so on  

 

For instance, hypothetical, let's say I'm in the UK and my closest relay server is in Amsterdam. The other player is in New York. It's possible for the route via relay to still be faster than the direct route, if my ISP's routes to the other player's ISP suck. This is usually the case even, ISP's prioritise things like Microsoft, Fastly, Cloudflare and so on.

 

Otherwise, again, spot on.

[Speyedr]

31 minutes ago, Spider-Vice said:

Also surprised they actually got extra servers from Azure for some other regions of the world.

Those Azure relay servers have been in use since at least Online 1.54 to bypass strict firewalls or other unconventional network setups. I have packet captures from years ago that include them (Azure Sydney, specifically).

I'm still not sure if they've actually introduced any "new" relay implementations for in-session activity. Either they're attempting to route people more frequently or it's just a coincidence and no one really had a reason to investigate the relay tech before this. Haven't had much time to test busy sessions yet; been focusing on the new Guardian heuristics instead. One thing of concern (for Guardian, at least) is that shielded IPs probably can't be supported, because obviously the IP source in the packet headers is not the player's it's the relay server, and as mentioned above they try to use those exact same servers to bypass firewalls anyways.

I have a couple of tests lined up once Guardian is properly fixed and will investigate how often people get relayed when compared to previously.

[Spider-Vice]

11 minutes ago, Speyedr said:

Those Azure relay servers have been in use since at least Online 1.54 to bypass strict firewalls or other unconventional network setups. I have packet captures from years ago that include them (Azure Sydney, specifically).

Ah I see, still good to see though that they're not sticking to the few T2 owned servers in Amsterdam, NYC and California.

 

11 minutes ago, Speyedr said:

Either they're attempting to route people more frequently or it's just a coincidence and no one really had a reason to investigate the relay tech before this. Haven't had much time to test busy sessions yet; been focusing on the new Guardian heuristics instead. One thing of concern (for Guardian, at least) is that shielded IPs probably can't be supported, because obviously the IP source in the packet headers is not the player's it's the relay server, and as mentioned above they try to use those exact same servers to bypass firewalls anyways.

I mean, before every single player's IP in a session was exposed and now it doesn't seem to be everyone's, so something has changed, don't think it's a coincidence. It's indeed a concern for Guardian as a tool if most players are being relayed now, but I think that's just an unfortunate (for some of Guardian's functionality) consequence of heightened privacy in a P2P game... I think a lot of players would be pleased that their IP's aren't being shown to random script kiddies with mod menus anymore. It's one of those difficult situations for tools such as yours lol

[needforsuv]

56 minutes ago, Spider-Vice said:

GeoIP'ing a residential IP

my isp's thing is only accurate to the city and not the suburb

 

so I'm good on that, plus dynamic ip