HWID Ban

[Muffins 1]

hello everyone,

so i just recently installed this system:

 

but for some reason when i ban a player, there are other players gets banned too

when i look for their hwid, they'll be exactly the same as the one that i just banned, 

 

is it possible that the hwid can be the same for the other devices too ?

[lime 261]

HWID is unique. 

No HWID is the same as another HWID. 

Edited September 26, 2024 by emjl

[Muffins 1]

thanks

[Gurgarath 3689]

5 hours ago, emjl said:

HWID is unique. 

No HWID is the same as another HWID. 

Actually this is wrong (despite being theoretically true). Based on many factors, the HWID can be the same and can also be spoofed (changed by a cheat, by the user, by switching a piece of hardware or by sending a fake packet by hooking on the auth function). Some players using Shadows or any cloud gaming services will share the same HWID. Also, even if it is rare, HWID can simply collide and be the same; also, ironically it will not be two players but literally 20 with the same HWID when it happens (and it is bound to happen). This method is far from being secure and can result in many false positives.

[lime 261]

54 minutes ago, Gurgarath said:

Actually this is wrong (despite being theoretically true). Based on many factors, the HWID can be the same and can also be spoofed (changed by a cheat, by the user, by switching a piece of hardware or by sending a fake packet by hooking on the auth function). Some players using Shadows or any cloud gaming services will share the same HWID. Also, even if it is rare, HWID can simply collide and be the same; also, ironically it will not be two players but literally 20 with the same HWID when it happens (and it is bound to happen). This method is far from being secure and can result in many false positives.

I am gonna play on your server, make you ban me and then sell you my SSD. Ta-da! Locked out of your own creation!

[Koray 3305]

@ Gurgarath, I don't think a well-written system would have the issues you mentioned at those stages. HWID is a much more secure system compared to other methods and alternatives. To explain better:

Quote

the HWID can be the same

While it’s true that certain HWIDs like MachineGUID or disk serials might result in similar values across devices or some dummy placeholder values, the solution lies in using more unique and reliable identifiers. E.g, by combining the permanent MAC address of the physical network adapter, GPU/Monitor serial numbers, and Windows User SID, you can ensure a much lower chance of duplication. This method effectively reduces the likelihood of matching HWID values to almost zero, especially when these values are combined and cross-referenced.

Quote

can also be spoofed (changed by a cheat, by the user, by sending a fake packet by hooking on the auth function)

Spoofing is a valid concern, but it can be mitigated. One approach is to generate the HWID during the first run of the client and securely store it on the machine in a hidden location. During later launches, this HWID can be verified on the serverside, ensuring that any spoofing attempt is flagged. To further protect against cheats, you can secure the client with anti-hook measures and use non-standard network encryption. These attempts will make it exceedingly difficult for attackers to tamper with the HWID system.

Quote

by the user, by switching a piece of hardware

Hardware swapping is a known challenge, but the key to overcoming this is by using a combination of HWID values from different components like explained in above. Focusing on identifiers from more costly and less frequently swapped parts (like the GPU, motherboard, or TPM) makes it harder for users to bypass the system. Combining these values into a multi-factor HWID strengthens the integrity of the system, making it much less vulnerable to simple hardware changes like you mentioned.

Quote

Some players using Shadows or any cloud gaming services

This is why many top-tier anticheat systems (like VALORANT’s Vanguard, EAC or BE) block virtual machines and indirectly cloud services. By preventing the use of virtualization or emulation tools, you eliminate the risk of HWID circumvention through these means. It’s a necessary trade-off to maintain the integrity of an anti-cheat system.

TLDR; HWID (as a single value or just in its raw form) does not offer complete protection and can NOT be secure but if you build the system in a secure and reliable manner, the chance of running into problems becomes much lower.
 

[Gurgarath 3689]

1 hour ago, Koray said:

@ Gurgarath, I don't think a well-written system would have the issues you mentioned at those stages. HWID is a much more secure system compared to other methods and alternatives. To explain better:

While it’s true that certain HWIDs like MachineGUID or disk serials might result in similar values across devices or some dummy placeholder values, the solution lies in using more unique and reliable identifiers. E.g, by combining the permanent MAC address of the physical network adapter, GPU/Monitor serial numbers, and Windows User SID, you can ensure a much lower chance of duplication. This method effectively reduces the likelihood of matching HWID values to almost zero, especially when these values are combined and cross-referenced.

Spoofing is a valid concern, but it can be mitigated. One approach is to generate the HWID during the first run of the client and securely store it on the machine in a hidden location. During later launches, this HWID can be verified on the serverside, ensuring that any spoofing attempt is flagged. To further protect against cheats, you can secure the client with anti-hook measures and use non-standard network encryption. These attempts will make it exceedingly difficult for attackers to tamper with the HWID system.

Hardware swapping is a known challenge, but the key to overcoming this is by using a combination of HWID values from different components like explained in above. Focusing on identifiers from more costly and less frequently swapped parts (like the GPU, motherboard, or TPM) makes it harder for users to bypass the system. Combining these values into a multi-factor HWID strengthens the integrity of the system, making it much less vulnerable to simple hardware changes like you mentioned.

This is why many top-tier anticheat systems (like VALORANT’s Vanguard, EAC or BE) block virtual machines and indirectly cloud services. By preventing the use of virtualization or emulation tools, you eliminate the risk of HWID circumvention through these means. It’s a necessary trade-off to maintain the integrity of an anti-cheat system.

TLDR; HWID (as a single value or just in its raw form) does not offer complete protection and can NOT be secure but if you build the system in a secure and reliable manner, the chance of running into problems becomes much lower.
 

Well, you went in-depth and it is good, I have nothing else to say or to contradict! But I was _especially_ about the system he linked, which uses machine GUID and that is known to have collision (I myself had the issue). Anything related to hardware can be considered an HWID (Disk serial, Mac Addy and so on), each with their own flaws and the worse is simply for an attacker to know what metrics or what method you use.

I would however add that mixing two or more methods within a single one is counter-productive and will increase exponentially the number of flaws; let's say you make a combination of GUID, CPU ID and Mac to get a single output, changing one of those will change the entirety of the output and is to be avoided. However gathering multiple telemetry to get some kind of an overall fingerprint of the user is the way to avoid most issues.

I also faced this issue and ended-up doing my own multi-factorial identifier for this exact reason, which I would obviously not go in detail about how it works. About spoofing, anything that goes in tandem with the server (a validator, a key encryption and decryption...), should be able to keep most attempts at bay.

Edited September 27, 2024 by Gurgarath

[Muffins 1]

thank you all,

i get what you mean by that,

that i should add more methods to verify the player's device to avoid similarity with another player.

Edited September 27, 2024 by Muffins