Spotting and catching hackers

[Combine]

Team Fortress 2

Spotting and Catching Hackers

 

Now anyone who has played TF2 as long as I have will know that it can be difficult for newcomers to catch and spot hackers. so, I figured making a guide on catching and spotting hackers would be a good idea. However, this guide is aimed towards new Admins and Moderators so it will have information that most older Moderators and Admins will probably already know about.

 

Spotting and Catching hacks

When you first suspect someone join spectator and watch them in first person. You will want to look for shaky crosshairs. Many aimbots will shake the mouse cursor really fast usually in small circles or back and forth. This is usually to prevent Hack-detection systems such as VAC and server-side plugins from detecting the hacks. Since the mouse moving really fast, the Hack-detection system(s) will assume that its a player is just moving the mouse really quickly and will usually ignore them, as opposed to detecting little motion with quick bursts of motion usually resulting in kills.

Basics of Hacks

These aimbots will usually stay shaky all the time to mask the aimbot. However, some of the more subtle hacks won't shake until the player is actually firing. This can sometimes be harder to detect by the eye because some people naturally use high sensitivity and the lack of shaking can mask the aimbot into looking like someone with high sensitivity. Now just because someone is heavily shaking or shaking when they shoot does Not mean they are hacking. Look at the motion of the shaking. Check to see if it looks "scripted." Look for the exact same patterns of shaking or movement when they fire or aim. If it is hacking it will usually look almost the exact same and look more of a scripted aim then a human aim.

Another thing to watch for is somebody getting kills but the crosshairs are nowhere near the target. This requires watching the kill feed in the top-right (default) and the player at the same time. Some aimbots like this will send a "spread bullet" into a pre-determined spot on the player's screen to guarantee a kill. This isn't that common of a hack though as TF2 bullet spread is garbage.

Hitting Cloaked spies

The most common thing you'll see is a suspect hitting cloaked spies. This is because your client (game) knows where cloaked spies are at all times. However, they just are never visually displayed on your screen. Since the game knows the location of all players without having to see them, most aimbots will most likely shoot or snap to a cloaked spy. A good tactic when you have a suspect is to get someone on the opposite team while you spectate them. Get that person to run around cloaked as a spy for a bit. If you see the suspect hit or kill the cloaked spy without them ever being visible, then you got yourself a hacker. However, some hackers will do something called baiting. If a hacker knows the spies location they might not shoot the spy but, try to bump into them. Once the hacker touches the cloaked spy it will reveal the location of the cloaked spy. This is where they will shoot you. They often do this to mask their hacks and can in fact trick people. When catching these guys look for the suspect going towards cloaked spies and bumping into them over and over again, no matter where they are. This can be very obvious if the cloaked spy is in a large open area.

Name changing

Probably the most common thing you'll run into is hackers changing their name to other player's names. This makes it harder for un-experienced admins or moderators to ban the hacker. If someone is changing their name fast (like really fast) console will eventually perm them. However, sometimes these hackers don't switch the names fast enough and will require you to spec them. To ban them simply just type "status" in the console and on the left side there will be a # with a number (ex: #225). Write both of the numbers down(for both matching players) and wait for the hacker to do another name change. Then type status in the console again. Whichever new name has the same # number, That will be the hacker.

Custom Hud Hacks

Custom Hud hacks are not just 1 hack. It is a variety of hacks. These hacks usually only come in mod menus like LMAOBox or Nullcore. Now, these hacks usually have mini maps in them and something known as a "rear cam." Mini-Maps, Most of the minimaps out there don't actually render the map. To hide from Hack detection software, They have preloaded maps for the mini-map, These hacks usually just have the stock tf2 maps. However, sometimes the hack does actually render the current map on to the mini-map, this is usually caught very easily by VAC. Rear-Cam, Rear-cam is what it sounds like. It's a rear camera that is placed on to your hud. This type of hack has a box at the top of your screen. This box projects an image of what is behind you. This way they know what is behind them at all times. Now mini-map can be caught usually if the suspect is constantly following people no matter their location, even if they cloaked or going to different spots each time. The rear camera hack is able to be caught, it usually becomes obvious when they are using it when they constantly turn around when someone is behind when, even if they are cloaked. However, since people can listen for foot sounds with surround sound it can become difficult to catch these guys as this might not be hacking at all.

Wall Hacks

Wallhacks are another common hack for people to use. There are many types of wallhacks and some make walls in the map visually transparent so that you can see everything behind them while others just outline players through the walls. The best way to catch a wallhacker is to look for the suspect aiming the crosshair at a wall with a player behind it. Usually, players that don't care or don't know how to hide it will often do this. Often their crosshair will follow or trace players when they are behind objects like running in a tunnel or what not. Tracing is a common thing novice wallhackers will do. Most of the time, they'll start shooting at an enemy player before they're visible. This is because depending on the hack it can be difficult to tell if the person is behind or in front of an object.

Triggerbot

Trigger bot is a hard hack to detect. Triggerbot will usually just autofire when you hover your mouse over a player. It will not have any sort of flicking or shaking. Trigger bot can also be specific toward the body part that triggers the shot. For snipers using triggerbot will usually have the shot only register on the head. This means they can, in fact, hover over another body part and it will not trigger. Triggerbot is almost impossible to detect however, most novices will usually shake the screen themselves to try hit people. This will usually be horizontal strokes and will look human. But can be detected. Here is an example of triggerbot strokes

Triggerbot skins. In TF2 you can have an assortment of skins, they can reskin more or less anything in the game.  Most skins are fine, however, with the access, we have on TF2, there is an unlimited possibility for making skins or custom mods. Some skins just say can making everyone on the opposite team bright green, and will also glow through walls. This is usually combined with a macro that left-clicks every time the pixel in the center of your screen is green (or whatever color the enemy is skinned to).

Barrel Hacks

This isn't really a hack that needs mentioning since its more or less impossible to detect but I thought I should bring it up anyway. Barrel hacks are a difficult and nearly impossible hack to detect. The hack is usually easier to spot in games such as CS:S or CS:GO. The hack will draw straight lines out of the barrel of every gun for enemies. This way the hacker will know exactly the direction the enemy is aiming at. This gives them a good feel for where enemies are, without actually using a wallhack. It will also let them know if they're in immediate danger of being shot at or followed since they can tell where ever gun is pointing. These hacks are virtually impossible to detect, even by experienced users. However, you can sometimes tell when they are hacking. Some hackers that use barrels hacks will start ducking or crouching before the enemy player starts shooting. this indicates that the player knows that an enemy is looking in their direction. However, since TF2 is a chaotic game and even worse on our servers. It's really hard to catch these guys since they could just be ducking to someone else.

Spinbot

Spinbot is something that isn't used very much since it's so easy to detect. These hacks will usually do what they sound like they do. That is spin around and around. To catch these guys it pretty simple. If the person looks like they have 20,000 DPI on a mouse and shooting people like bread & butter there is a good chance they are hacking.

Modification Hacks

Modification hacks aren't used very much as VAC will destroy you like garbage killing plant life. However, it's something that does come up rarely so, its good to talk about it. This type of hack can also be mixed up with admin abuse. There is literally no limit to what these can do. But the most common thing is someone getting shot and receiving health instead of damage. Most likely you will see things like anti-backstab, anti-melee, sniper charge limiter, weapon stat mods(heal arrows, etc), fast weapon deployment, etc. This genre of hack will more or less break the logic and physics of the game.

No Bullet Spread

No bullet spread. This hack is one of the hardest hacks to catch. Even with my experience and knowledge, it's the only hack I haven't banned someone for. The hack will do what the name suggests. It puts bullet spread for all ranged weapons to 0%. Now it is extremely hard to detect but most novices will be heavy and shoot people like they are a foot from that target, even if they are across the map.

Silent Aim

Silent aim is a difficult hack to catch. It's well silent. It works a lot like aimbot but instead of snapping like a mad man. It snaps within a cm or two of the body and makes it look real. The hack it a mixture of triggerbot and aimbot. combining both the stealth of triggerbot and the efficiency of aimbot. To catch these hackers, look for small and short snaps within a long period of time. It uses that to mask the hacks from anti-cheat software or plugins like VAC.