Exploit Prevention Update

One more thing: would exploiters make a painful decision to switch to Linux if some Roblox devs (maybe incl. Bitdancer) decides to do an Experimental Alpha/Beta release of Roblox on Linux?
No, I am serious: lets try making another free Honeypot lol, lets see what happens)))

1 Like

Only :star2: dev is an actually not a dumb person: he really knows what he is doing, unlike other exploiting devs.

Desktop version of Linux was supported, they blocked it 3 months ago or so. You can only play roblox on linux if you’re using the android distro (allowing exploiters to exploit easily without problem).

However there’s some workarounds such as virtual machines (VFIO GPU Passthrough) or using mobile emulators. Both can be difficult to setup but work alright for most. For the virtual machine you need some CPU features in QEMU/KVM XML, but RoL (Roblox on Linux) communities can help you with that.

5 Likes

Will Hyperion be implemented into Roblox Studio?

Dont even think about it for now
Think about the studio itself:
Exploiters havent managed to access normal games from a studio, like ever
If they somehow find out how to do it, then Roblox would patch it, or implement Hyperion there.
Otherwise, just, dont even think about it, just for now.

It’s been stated in another thread that they currently do not have any plans to implement Hyperion into studio.

1 Like

How would that even work? Aren’t they two whole completely different systems?

No they’re not, studio is essentially a wrapper around the original roblox but slightly modified so you can’t just teleport to a normal game, it’s possible for someone to do but it’d be a pain.

I see, thanks. If this somehow does get accomplished, it’ll be a bit interesting to see what damage could be done

1 Like

Will you guys start permanently banning users caught exploiting? With other waves they’ve only been temporary, from what I’ve seen.

1 Like

As far I’m aware roblox has made it: 1 day > 3 days > 1 week > term, this is probably for the best due to there being false flags in the past

4 Likes

Unlikely. Roblox prefers to give infinite second-chances and exploiters realize this, which is why they’re gradually returning to the platform this whole year despite historic lows at the end of 2023. Byfron team doesn’t have permission to actually ban, they need to fill out some lengthy form and hand it over to karen at trust&safety before they’re allowed to even do a single-day ban. This is why the 1-3-7-termination thing never actually hits the termination stage. It resets after a month too I believe so if there isn’t more than 1 banwave in a month, everyone gets a free bonus life.

So yeah, expect an increased amount of exploiters unless Roblox decides to change their policy

5 Likes

For good exploiters, infinite lives are good, plus they start to be more careful, being in the closet, the risk is real, the bans actually teach them something. For bad exploiters, infinite lives won’t teach them a lesson, they would risk even more, they don’t care, they can just make an alt, etc.

Looking at VALVe rn, they actually banned aimbotting bots in TF2, and temporarily their hosts and closet cheaters, because they wanted to give them a second chance. Guess what? Hosters didn’t care, so VALVe just banned them permanently afterwards, because they had the chance, and they refused to switch sides! Don’t know about the closet cheaters tho.

1 Like

You guys should look into kernel level anticheats and maybe implementing easyanticheat and such. The only way to bypass this would be a DMA, but based on other games there is no way to detect a DMA which is where a built in server side anticheat comes into play, This can detect irregular movements and such and mark the player for review by an admin or the creator, For smaller games it should be the creator only as there is no way to verify that the game creator itself isn’t doing it to get them banned however for larger games such as bedwars, this would also be moderated by roblox admins and such and punishments would happen on their whole account rather than just in that game.

7 Likes

There is no need for a kernel level anticheat as Hyperion is already doing good enough of a job from UM, if you’d like a serversided anticheat it isn’t hard to make one yourself aswell as many resources showing you how to make one.

7 Likes

Not sure its the great time to do so… Because if theres somehow an corrupted kernel file due to that, it will be the same situation as it recently happened a few days ago, but for every single roblox users.

3 Likes

Not as likely, It would be easier if they just used something like easyanticheat, and that dosen’t modify the kernel in any way, it just operates on a kernel level allowing to to watch over and make sure no injections happen.

3 Likes

I have one and know how to make them, I am talking about a very strict platform wide anticheat, And it is so easy to bypass hyperion and byfron, Solara does it, Wave does it, It is very easy once you understand how it works, just not many people put in the skill and know where to look as it is mostly undocumented, I could make my own executor if I wanted to, however I don’t want to be responsible and I myself are trying to prevent hacking.

3 Likes

Solara, Wave, Electron and celery are all detected, they merely bypassed hyperion’s frontline of crashes. They’ve all had previous banwaves and continue to use the same methods which gives Hyperion devs even more bans. Ontop of all of this making a kernel anticheat comes with a whole wave of issues such as privacy concerns, possibilities for vulnerabilities. A kernel anti-cheat would not be a good fit for roblox and would simply just be avoided by moving to the UWP version of roblox.

4 Likes

You’re right, Hyperion detects all of those incredibly well and publicly released cheats are pretty much all detected. However detection means nothing from a developer’s perspective. We have zero way to leverage it and the ban waves are too limp-wristed and spread out to make a dent. Exploiters are returning, metrics show an uptrend all throughout this year. It is reaching levels about equal with pre-UWP Hyperion. It is clear that this ‘detection’ doesn’t deter anyone when you can simply hop to an alt or wait the one-day and go right back to injecting.

Hyperion either needs make a significant step forward with an EAC-like low-level component or start taking ban waves more seriously. Check out Apoc Rising 2’s ban stats, which are public. It’s climbing back rapidly thanks to free executors existing unpatched.
This is an over 1500% increase compared to December. Something has to change here. Usermode Hyperion worked great, past tense. It’s clearly not enough anymore.

I still believe an opt-in kernel/driver level client is the best move, which Bitdancer also thought about a while back. Games like bubble popper simulator won’t be impacted while the most competitive games can choose whether or not they want to enable it.

1 Like