We spoke to Scott Albright, the founder of Ghosts of Tabor developer Combat Waffle Studios, about Tomahawk, his team’s anti-cheat solution for VR gaming.
Scott joined us for this week’s UploadVR Gamescast to talk about how his team came to build Tomahawk and the experiences they’ve had with VR developers and communities while attacking the issue of cheating.
Below are some highlights of the interview. You can catch the full conversation on our YouTube channel or wherever you get your podcasts.
The issue with current anti-cheat solutions for VR
Scott: There was no software other than Meta Attestation. That was it and it’s absolutely horrible. None of your major anti-cheat platforms, BattlEye, Easy Anti-Cheat, none of them run in a standalone environment. They just don’t work. They never built them for that. So while we use BattlEye on PC and it’s great, it’s also still easily hacked by smart people. But Meta Attestation was the only thing on the standalone platforms that provided any type of security, and it’s so easily bypassed. Kids are just doing it with AI. We call them skids, script kids. They do it in the blink of an eye. It doesn’t take any time at all. They’re through it immediately.
Tomahawk has already proven to be effective
Scott: Yeah, we’ve stopped around probably 200 rooted devices so far, if I had to guess. Overall, attempted cheaters in VR since we launched to the open public, which would have been, I believe, last year, we’ve stopped 4,000 modified APK users and almost 5,000 attempted cheaters. And we have over a thousand bans already active throughout all of our games. We’re currently protecting 2,000,600 accounts across all the titles that we protect.
Steam Frame will be problematic
Scott: The Frame is going to be hard to stop, because the Frame, from what I understand right now, is going to be pretty much open source where you can do whatever you want to on it. It’s going to be rooted from Steam and they don’t care. So, that’s going to be a hard one.
We have a couple Steam Frames in the office. We’re part of their whole testing pilot program that they did along with a bunch of other developers. So, yeah, we’ve been working on it for a while. Not sure when it’s going to launch yet, but we still haven’t solved it yet. We have a pretty good idea what to do, but it’s a lot of testing to make sure we don’t brick people’s headsets on accident.
Scott hired the biggest cheaters in Tabor
Scott: We have a three-man security team. So Tomahawk is actually birthed from our biggest cheaters in Tabor. We did what the Feds do. I found our biggest cheaters and we hired them. They developed Tomahawk and they’ve been cheating since like old day Call of Duty. Made a lot of money in Bitcoin doing COD cheats back in the day. We brought these guys [in] and turned them legit. At first, it was like, well, will they stay? And it’s like, will they get the same rush from catching cheaters as they do as playing the cat-and-mouse game as a cheater? So that’s why they’re so into it.
The kids are relentless in their cheating efforts
Scott: These kids are relentless. I applaud them for their ability. If they put as much time in trying to modify Animal Company and Yeeps and all these other titles as they put that into schoolwork, they would probably be geniuses and the next Albert Einsteins to be honest with you. They’re creative and AI has only helped their creativity, right? Mostly modified APKs. That’s mostly what they’re able to do because Meta Attestation does not stop it. They do not do anything.
We check every bit and byte of every APK to make sure it matches 100%. We’ve even told Meta how to do this and they refused to do it. We’ve told them how to stop it. They won’t do it. We had meetings with the security team. They told us cheating in standalone can never happen. Boom. Here we are. So, we did it ourselves. They told us rooted headsets could never happen. Boom, here we are. So, we stopped it ourselves.
If you would like to learn more about Tomahawk, visit the official website Tomahawk.gg.
