Report: Valve anti-cheat scans your DNS history

Valve is looking at your browsing history right now, if a recent report is to be believed. It seems that the company’s Valve Anti Cheat system (VAC) reportedly looks at all the domains you have visited, and if it finds that you’ve frequented hack sites, who knows what actions it will take.

Valve Software

Keeping an eye on things

UPDATE: Gabe Newell, co-founder and CEO of Valve has made a statement about Valve, VAC and Trust, explaining that yes, the company is scanning your DNS cache, and detailing exactly why – as well as how it will affect you.

Every time you visit a website, your PC stores a record in a Domain Name System (DNS) database. This is similar to your browser’s cache, but keeps details across everything you use to access the internet – browsers, your email client, messenger programs, Twitter client, even that weather gadget that lives on your desktop.

The thing is, the DNS cache stores details of every site your computer has touched, whether or not you’ve actively visited it. If an article you are reading links to a blacklisted site, your DNS will record the address of that site, as well as the article. More subtly – if a page you are reading is using a graphic hosted on a blacklisted site, then that blacklisted site will again show up in your DNS. Even if you’ve never actively visited a cheat website, there may be traces of them in your DNS, and that’s what VAC is reportedly now looking for.

The news was first posted to the Counter-Strike: Global Offensive Reddit, explaining that VAC now:

  • Goes through all your DNS Cache entries (ipconfig /displaydns)
  • Hashes each one with MD5
  • Reports back to VAC Servers

It is not immediately clear what happens to the MD5 hashed data when it returns to the VAC Servers, but it seems likely that the list is compared against a database of known cheating services or websites.

The new functionality has been slammed by gamers, who claim it is “more like spyware than anti-cheat”. Valve has not responded to the allegations, but all Steam users have agreed to abide by specific online conduct and not to use cheats. The company’s privacy policy also explains that Valve may collect “personally identifiable information”, but promises not to share it with other parties.

VAC bans happen all the time, with more than 60 games using the service. The timing of this allegation is interesting – in recent days there has been a “huge” wave of bans, many affecting zombie survival title Rust, which uses the VAC system.

While it is an interesting anti-cheat approach, it is not infallible. Your local DNS cache is not stored permanently, and can be flushed with a simple command. We have contacted Valve to find out what’s going on – but in the meantime, it can’t hurt to be careful where you tread online.

Tags: , , , , , , , , ,

Facebook Google+ Linkedin Pinterest Reddit Stumbleupon Tumblr N4G Twitter