I feel like Niantic only handles high-profile spoofing incidents

HosetteHosette ✭✭✭✭✭

In the last couple of years I and others have had excellent luck getting high-profile spoof accounts banned very quickly, and the vanguards have helped get portals restored. The cases I've dealt with have involved high-value durable portals, such as those that require a difficult mountain hike to a very remote location.

This week I observed an account leveling up in my city that appeared to be either spoofing or someone's alt based on play patterns-- L5 accounts don't build a portal with VRMH/VRHS, glyph it for lots of keys, then expertly microfield an area at 2-3 a.m. I mentally filed it as suspicious and decided to keep an eye on where it was playing.

The next afternoon the same account was seen playing inside of two areas that were inaccessible. One was an amusement park that had closed hours earlier and the account was building portals that aren't reachable from outside the fence. The second place it played was a public garden, also closed and the account was also capturing and linking portals that aren't reachable from outside. I reported it, and the report was closed but the account was still active.

That night just after midnight I noticed that the account was playing a couple of blocks from where I was so I parked my car on the street directly in front of the path that they were taking and waited. Sure enough the account went right by me although nobody was present. The range was such that there was nowhere else they could be but on that street to take the actions they were taking. Eventually they turned a corner. I pulled around and observed nobody present then smashed the portal they were linking from and that was it... they went dark for the night. I filed a second report which was closed.

This morning the account was spotted 800 miles north of me in another big city.

I feel like only "big-ticket" spoofing gets handled, and the rest is ignored.

«1

Comments

  • Spoofers accounts are a real headache. I understand you 😕

  • TheKingEngineTheKingEngine ✭✭✭✭✭
    edited June 2021

    Yes. And not all high-profile spoofers, if restricting to "Ban" as a solution to identify whether it's handled or not because it's the only way for us.

    Usually it's those interacting with portals in remote area espeically on moutains, or when even K-12 students can instantly notice the impossibility (Impossible Travel Time).

    And not all reports that shows significant impossibility. And still not all of those accounts.

    Usually it's those not having yet purchased C.O.R.E. and other quite many paid medals and not "founders".

    That's why some XMAs and Vanguard will tell players and thus make players sad that "the reporting of anti-spoofing is working" or "Niantic surely can see everything" because 1%~10% of the cases that meet those criteria are indeed handled properly (delivering a ban), usually with the help of Vanguards because you make contact with Vanguards when problems occur with high-profile portals. However we players are working and fighting with the rest, that is, >90%, not involving mountains and not high-profiles, but still definitely spoofing with solid evidence according to in-game action logs (which Niantic would take into consideration) and other documents (which Niantic WOULD NOT review)

    Post edited by TheKingEngine on
  • TheKingEngineTheKingEngine ✭✭✭✭✭

    @Hosette could you kindly let me know which part you would like to put disagree on, literally?

    As far as I can see what I said from my own experience could be an elaboration of your idea.

    Which is based on agreement with your assumption, but it seems that you Disagree all of them.

  • From a data perspective, it's hard to judge if an account is spoofing or not.

    The only thing that confirms the spoofing of the account you saw, was you not seeing it in real life.

    That is not something Niantic can verify.


    The high-profile spoofs (that do get bans) are usually done by accounts that have not been active anywhere near the high profile target and might not be as active altogether, raising a bigger flag.

  • GoblinGranateGoblinGranate ✭✭✭✭✭
    edited June 2021

    If you think about it, it makes no sense at all.

    Bans do happen, but Niantic has theoriaccly no way to tell if someone is spoofing, but when it comes to specific portals there seems to be no doubt as ban can be delivered in less than 2 hours.

    So what's going on there? Is it that they are only getting their attention in those tickets escalated from a VG? Just like the old TR...

    I've recently noticed, from submitted tickets, that 2 tickets I submitted for different reasons got closed at the same time. Tickets were not related to each other, yet the got closed at the same time and that is VERY suspicious about how carefully they were reviewed.

    Also, there is a known case of a ban that happened last summer on a high profile portal in a high profile island but agent was no spoofer. Agent actually decided no to appeal because "this game is worthless" and never came back. Perhaps somebody from support "Trusted" someone else?

    All these events are to be taken with great care...

    About urban spoofers, I met a lot of those, you won't get a ban from that, no matter how obvious it gets. They say spoofers only affect older players, but any freshman would decide to quit if they notice they are being ghosted. Never forget: this game shares you location in real time.

  • HosetteHosette ✭✭✭✭✭

    @XQlusioN Given the amount of data that Niantic has it can be easier than you think. Niantic has built-in spoof detection and I've seen cases where a spoofer was automatically shut down after taking only a very small number of actions. Because I have a professional background in fraud detection and I've also run a small game server for a couple of decades I have a little bit of expertise. I've also put a lot of thought into how I would create an anti-spoofing system if challenged to do so. Conceptually it's easy, and I could explain it to my 84-year-old mother in a way that she could understand. (That's not as out-there as it seems... she has an undergrad degree in math and an MBA from a prestigious university and she spent her career in medical research. She's pretty sharp.) The devil is in the details, and the details change constantly.

    Spoofing is a cat and mouse game. Niantic learns to detect spoofers, then spoofers develop new techniques, then Niantic learns those techniques, and... lather, rinse, repeat. I also know from a discussion with someone at a meetup that a spoofing report actually triggers Niantic to examine their internal data. Let's say hypothetically that for every in-game action Niantic calculates a spoofing score that goes somewhere from 0-1, where 0.0 is high confidence legit and 1.0 is high confidence spoofer. The signals aren't perfect, though, so lots of legitimate actions have scores above 0.0. Perhaps 0.7 or above triggers Niantic's automatic ban hammer. Below that, the action goes through but if Niantic gets a spoofing report they look for more details and then make a decision.

  • @Hosette I would love to hear your anti-spoofong mechanism. If not here, I'm also on TG under the same name.

  • TheKingEngineTheKingEngine ✭✭✭✭✭
    edited June 2021

    A spoofer was automatically shut down not because of any reports. Its was because Niantic detects directly from the device that that account is spoofing. Most professional spoofers won't get caught here. It's nothing about the algorithms.

    If you could explain it to your 84-year-old mother as you said, could you kindly, again, let me know which part did you disagree with my elaboration of your own theory, even after I raised undeniable examples? Moreover, describing and referring to the real cases is better than addressing "Let's say hypothetically", what do you think?

    Fine if you actually did not intend to discuss the topic you brought to us seriously.

    Post edited by TheKingEngine on
  • TheKingEngineTheKingEngine ✭✭✭✭✭

    Actually it's not that hard. Some sensors like accelerometer on the device can help Niantic determine whether the GPS data sent from device to server indicating the movement are illusory or not. This also matchs some cases where some spoofing accounts made a lot of works around an area or mutliple areas but with its trekker/walking distance not really increasing.

    The real problem is Ingress team is relying on PoGo team to implement better anti-spoofing code but PoGo team does not really care about it.

  • It's just as easy to fake any sensor data as it is with GPS.

  • TheKingEngineTheKingEngine ✭✭✭✭✭
    edited June 2021

    But most of the spoofers won't do that generally until their accounts getting frozen for so. By doing this at least we could eliminate a batch of spoofers.

  • Most spoofers use tools... All that needs to be done is update those tools and we are back at square 1.

  • GoblinGranateGoblinGranate ✭✭✭✭✭

    It at least would give communities some hope! What will ever be achieved if square 1 is always present?

  • TheKingEngineTheKingEngine ✭✭✭✭✭
    edited June 2021

    Yes. However what I would like to say is, it's very likely not a "cat and mouse game" because the cat is not upgrading and pursuing better techniques as far as I can see.

    Cat's doing something and let us know/notice is much better than cat's doing nothing. We see all the time that URBAN spoofers are almost not handled at all.

  • The issue with this is that sensors sometimes fail or report wrong data (not to mention the difference in accuracy and availability of those sensors in budget phones)

    I'm pretty sure that every single player has at some point submitted sensory data to Niantic that can be construed as being abnormal.

    Whether that is GPS drift or an accelerometer giving a weird reading due to being recorded at a specific time.


    In an ideal world, you would continuously track sensory data (instead of the snapshots now) to track anomalies, but that isn't feasible.

  • XQlusioNXQlusioN ✭✭✭✭✭
    edited June 2021

    Every thing costs money (dev time, resources, ...)

    There is a point where you have to ask yourself if it's worth it to spend time to implement something when you know it will be undone in days.


    Sure, Niantic would get praise for the banned accounts on those few days, but after that, they would get an equal amounts of complaints about spoofers as before they implemented it.

  • TheKingEngineTheKingEngine ✭✭✭✭✭

    Precisely, not complaints about spoofers, but complaints from spoofers.

    To some extent Niantic sees spoofers as same as normal players. That's one of the problems.

  • HosetteHosette ✭✭✭✭✭

    @XQlusioN Yes, sensors do fail. Software does too. I remember one time at a key farming party where we were all connected to the same wifi. Everyone around me was farming keys for a linkstar and Ingress thought I was in Korea. How my phone confused California with Korea is anyone's guess. One of the guys there worked on location services at Google at the time so I asked him about it and he basically said "It's complicated..."

    Smart models rely on patterns of data not one signal. See my above discussion about a score ranging from 0.0-1.0. A sensor reporting bad data might score 0.1 in that model. Someone connected to a wifi network in California while meticulously moving around Korea linking and fielding would be much higher. Someone connected to a wifi network in California, meticulously moving around Korea, and having just taken actions in London three hours before would be much higher. I'm being WAY overly simplistic about this...

  • MirthmakerMirthmaker ✭✭✭✭
    edited June 2021

    There are specific portals that I am sure are monitored so if they do go down, they get a look see as to who did it and acted on accordingly if it isn't real.

  • I hear that you are oversimplifying things. But I fail to see how sensory data would help in the example you give. Merely having comm as is should be enough to determine spoof from that.


    About the models and patterns that adapt, so do spoofers and their tools. The main reason why urban spoofers are less likely to be banned is because they'll behave like real people.

  • HosetteHosette ✭✭✭✭✭
    edited June 2021

    @XQlusioN Yes, spoofing tools adapt. I've noted that repeatedly. I am pretty sure that Niantic had a decent (but not perfect) anti-spoof system at some point. I suspect they have failed to invest in keeping up with changes in spoofing tech and patterns.

    How do you think comm is sufficient to identify spoofers? What algorithm would you use?

  • I have same problem with you, in my country spoofer have started using the neat way. like following road on the map, moving its location also follows the google map times calculation. But when I was at the location there was no someone passing or the road being traffic but he could move freely. 

  • If i'm. Comm didn't help you, some user with spoofing tools be like a normal user active on the comm and maybe making a drama to another user. But if you active to play this user never play, Otherwise if you didn't play this user definitely out for action, and if you try making a action. This user will suddenly stop playing.

    How can i Know? First, Because i'm often try To open scanner with full XM and using HC. And then following every of these people. Secondly, Some of them did admit it directly to me

  • HosetteHosette ✭✭✭✭✭

    @GhostFreak666 Sure, but that's one use case. And, in general, I think it's the less-valuable one.

    If someone shows up at a remote lighthouse on the California coast then maybe they hiked to it and maybe they didn't. Maybe they're a tourist, maybe they're a semi-retired player, maybe they're a spoofer. Comm doesn't give me anything that will help me know if there's a person there or just an account. I'm sure there are lots of clues in Niantic's internal data, but if the spoofer took even minimal steps to not be an idiot in comm then there's no way for me to know.

    (Being an idiot in comm: hitting a remote island in Alaska then hitting something on the California coast five hours later. It's going to take that long just to get from the remote island back to Anchorage... and that's assuming you hit the timing right for one of two daily flights. Yes, I saw this one and helped bust him.)

  • GoblinGranateGoblinGranate ✭✭✭✭✭

    But that is what I mean, how can they tell it isn't a real agent playing legally? For sure they must have a way for a solid identification and therefore there is a way to spread it across more scenarios.

  • HosetteHosette ✭✭✭✭✭

    I don't think there are portals that are specifically monitored. I've dealt with a metric ton of durable/anchor spoofs over the years including quite a few well-known durables and in most cases I had to contact Niantic to get the account banned. I've suggested before that Niantic could prioritize portals for anti-spoofing measures by looking only at a set of metrics to identify the ones that were more likely to be used as high-value anchors, since spoofing a remote anchor that's rarely accessed causes a lot more damage to the game than the ones in a downtown area with high turnover. I have no reason to believe that Niantic implemented this suggestion but it's possible that they did.

    (Metrics for identifying hard anchors included how frequently a portal is accessed, how long it had been held, the number of portals within some moderate geographic range, the average link length for the portal.)

    How can they tell if an agent is playing legitimately? I described that above. There are lots of subtle bits of data in Ingress that spoofers have to get exactly right, and most don't. You can train machine learning models to recognize patterns in those signatures to calculate the probability that any given action is legitimate. I don't have the time to type out an overview of modern data science but you're welcome to dig into the topic and find some understanding if you're interested.

  • MirthmakerMirthmaker ✭✭✭✭

    Agreed about your .1 to 1.0 as scale. .1 the drift is +/- 250-500m in an odd spot. 1.0 is I'm the Queen of England if that isn't a spoof.

  • JukkaJuuJukkaJuu ✭✭✭

    I think they just don’t have the time and resources to implement all of these great ideas that are presented here. Prefer to use these to make new games. We are now developing three new games: Catan, Pikmin and Transformers. At least two of these will be released as early as this year.

Sign In or Register to comment.