Saturday, 13 December 2014

Malma Bot - Part III

Just a quick update regarding the behavior of the bot operating out of Malma in Genesis. This is speculation on my part but it looks to me like Rhea may have broken his bot.

Though he's still online virtually all the time, he's not updating with his usual metronome like precision anymore. Now it often takes him an hour or more to respond which is more in line with a no-lifer doing it manually than a bot.

To me this implies one of 2 things.

1. CCP has communicated with him, worrying him he's being investigated for botting so he's being more careful and putting on his best "But I'm just a regular player who leaves his character logged in 23.5/7. Really!" act.

2. Rhea UI changes to transparency settings, blink notifications and so on have confused and broken his bot. Or maybe the cache format changed too, that'd break a lot of bots. Whatever, something changed and broke the bot.

Considering the behavioral change started with Rhea's release, I don't think that's just a coincidence. I'm inclined to believe it's a sign Rhea broke his bot rather than an indication he's worried about getting caught.

It's very likely he runs many more bots in multiple other regions at the same time. When a patch changes something that breaks the bot he has to do everything manually until the bot gets fixed. Genesis isn't exactly the busiest region around, it's probably low on his priority list so he doesn't spend much time updating orders there.

CCP should do that on purpose from time to time. It'd be a great tool to help catch bots. Change something that breaks the bots but isn't a problem for honest players doing it manually and see which suspicious players suddenly can't do the same things with the same precision and uninterrupted frequency they've somehow manged to keep up for months or even years on end.

Edit: I'm not crazy, Nosygamer has since posted proof (in the form of the botter's own comments and complaints) many bots were broken by Rhea CCP's War On Bots: Rhea Breaks Bots

23 comments:

  1. I think once caught as a bot, CCP should confiscate all ISK earned instead of a warning. Someone was caught botting? No problem. Confiscate all assets and isk to all accounts related. No this bullshit warning. Punishment should be so severe so that even if you bot under the radar for a long period, you know that by the end of the day it would take just one fuck up to lose it all. And I am not talking about just trading accounts. I am talking all characters related. Plus, for accounts that are not tied by IP, they should observe "suspicious" transactions and put those other accounts on "watch list".

    ReplyDelete
    Replies
    1. I agree, warnings are too lenient. Just ban em the first time... Permanently!

      For the "pros" anyhow. The casual guy running a mining bot once or twice a week for a few hours at a time I have a little sympathy for. He really doesn't hurt the game much and might stop after a warning or disciplinary (non permanent) ban. IOW, he's still reformable. The "pro" however isn't, he'll just tone it down for a while after a warning, buy more accounts after a ban and keep right on botting the whole time.

      I know for a fact in WoW the "pro" botters considering losing accounts occasionally to be a cost of doing business. The guys who botted all the time and sold gold too. Doing a little simple math it's pretty easy to figure out about all they had to do was bring in about 50 dollars a month per bot.

      50 bucks is enough to cover the cost of the first month (the most expensive with an account purchase), after that it'd bring in 30.00+ profit every month. 50 bucks was also a number I heard bandied about as being enough to be worthwhile but not so much it required too much activity and risk attracting Blizzard's attention too quickly.

      Run enough bots making 30 bucks a month each and he's making pretty good money. Many of them keep spare backup accounts around so even when they do lose a few accounts they don't lose any time (or money), they just activate the spares and keep right on going.

      Though I don't follow what botter's are up to (reading their websites, forums and such) in Eve nearly as much as I did in WoW, I'm pretty sure their methods and thinking are very similar. That's partly because I already have a pretty good idea what they think and do from my WoW experience and partly because Nosy does such a good job of covering that stuff here that I don't feel I need to.

      Delete
    2. I also know for a fact many high end guilds (talking guilds in the top 100 and top 1000 here) had botters in guild who sold other members gold. That was a great way for the botter to explain away large gold transactions.

      "He's a guild mate, I can't raid but I can help the guild by giving members gold".

      No doubt it's the same in Eve with corporations and alliances. After all doesn't it always seem like whenever a major botter gets banned he's a member of one of the largest corps / alliances?

      Delete
  2. Most likely reason is that he got a warning from CCP, or read your blog, and changed the parameters on his bot, to update less frequently and add some randomness to the update time.

    The bots which are online 23.5/7 and always update within 1-5 minutes are easily caught by CCP; the ones which automatically log on, update randomly within 1-2 hours, and then log off again are much harder to catch. I've reported a few to CCP, but they have apparently not stopped them.

    Check to see if his orders are still being updated through out the day/night. If so, then he is still using a bot. (Yes, there may be a few players who only sleep 1-2 hours at a time, and do nothing but play EVE whenever they are not sleeping, but I think this would be somewhat unusual, even for someone with no RL.)

    ReplyDelete
    Replies
    1. Agreed, he could be adapting, especially if he reads my blog.

      I don't tell everything here, particularly not things he can do in response to me or to hide his botting better. After all I don't want to help him.

      I think he's gotten away with it for a long time and gotten complacent about it because it's a slow region with not a lot of competition. Most competitors will give up after a few days or weeks of insta cuts.

      But I'm not most, I'll force him to either slow down and share the business or eventually he'll make it blatantly obvious he's botting that CCP can't ignore it and pretend he's not anymore.

      Delete
  3. One of the things that hampers the detection of market bots is CCP allowing cache scraping to occur. That activity helps to disguise the activity of market bots, since cycling through the prices to look for changes looks the same as cycling through the market in order to update the cache.

    ReplyDelete
    Replies
    1. I suspect there'd be a lot less market bots if cache scraping wasn't allowed.

      Delete
    2. When the new Market Crest in normalized they certainly will ban scraping.

      Delete
    3. Surely bots will just start using Crest data by then though?

      Delete
    4. That's the thing that worries me about Crest. That it will wind up being far more useful to bots than for real players.

      Delete
    5. That's assuming that CCP doesn't catch them. I heard that in order to get the market data, you have to use authCREST, not public CREST. I don't think many bot devs are going to give their information to CCP.

      Delete
    6. No but they can get authCREST for something else and have the bot use that. Steal some legal app's auth info or write a legal app of their own.

      I guess it really depends on how restricted authCREST is and how difficult it is to get ok'ed for access to it in the first place.

      Delete
  4. #3 he reads your blog and has realised he has been caught :)

    ReplyDelete
  5. the bot I had in my area has stopped as well. Not sure if it means anything

    ReplyDelete
  6. Noisy Gamer wrote about broken bots too. Looks like the new UI indeed broke many of them.

    http://nosygamer.blogspot.co.at/2014/12/ccps-war-on-bots-rhea-breaks-bots.html#more

    ReplyDelete
    Replies
    1. Yup, proof I'm not crazy. =)

      Many thanks to Nosy for going to the trouble of reading all those botting forums to gather proof in the form of the botters own comments and complaints.

      Delete
  7. The bot must've gotten fixed, today he's back to the usual perpertual and near instant cuts.

    I logged in and modified 22 orders, that took me about 2 minutes. Exactly 1 minute and 12 seconds after I modified my first order, he started cutting my orders. He cut most of them before I'd even finished all 22 of mine, waited 5 minutes for the order modification cooldown, checked again and cut the last few with the last one getting cut 3 minutes and 20 seconds later.

    ReplyDelete
    Replies
    1. 3 minutes and 20 seconds after I'd made my last cut that is, a little more than 5 minutes after his own first cut.

      Delete
    2. Bots are starting to get fixed, although the market bot I'm watching is still half-way broken.

      I did find something that, from the description from the dev, can easily be turned into a market bot with a simple macro. It's currently on the EVE-O forums.

      https://forums.eveonline.com/default.aspx?g=posts&m=5292480#post5292480

      Delete
    3. Yup, it'd be trivial for anyone who knows the slightest bit about scripting to fully automate that with an Autoit/AHK macro.

      Delete
    4. Didn't realize you were watching a market bot yourself.

      I did catch your post where you mentioned knowing of at least one broken market bot but I thought you were referring to the one I'm talking about.

      Delete
    5. Oh and if authCREST is going to be available to apps like Evernus or Evenexus that really worries me.

      Then it'll be just like in WoW where most market "bots" are actually collections of simple scripts automating input to the same mods honest players use (pressing the buttons manually though).

      For that matter many full blown WoW bots, including the longest lived, most used one, were actually just very large, extremely complex Autoit scripts. AHK tended to be used more by multiboxers (probably mostly because Autoit was practically synonymous with botting) than botters but some botters preferred AHK because using it was less likely to draw suspicion their way. Basically if you knew about those kind of things if you heard someone used Autoit you assumed he was botting, but if you heard AHK you assumed he was multiboxing.

      Delete
    6. Just realized today he's botting PLEX too.

      Gonna start pushing him on them, that just might be the ONE item CCP will take action over.

      Delete