Saturday, July 21, 2018

CCP's War on Bots and Illicit RMT Since Fanfest

Apparently, CCP's War On Botting and Illicit RMT has now moved to the EVE Online sub-Reddit. ISK sellers and botters have long used Reddit as a platform to either create negative feedback against CCP during ban waves or to advertise their wares. For example, in the face of reduced sales due to CCP conducting sales during the holiday season last December, a post went up on 14 December decrying how CCP ignores botting and illicit real money transactions. That post led to a huge spike of sales on Player Auctions, a well-known RMT site, with over 500 billion ISK sold the same day the post appeared.


Last Friday, another post, Confession of a botmaker, went up. The post is a member of a well-worn archetype: a long-term botting/ISK selling insider tells a story of how he made trillions of ISK without getting caught. And on 14-15 July, sales of ISK on Player Auctions increased, with buyers submitting reviews associated with 330 billion ISK in sales, or double the average daily amount sold in July up to that point. But then on the 16th, CCP Falcon posted on r/eve about an upcoming security dev blog. On the 18th, the security team delivered, announcing the following number of bans since February:

  • 8771 account bans for RMT related activities since February
  • 4250 account bans for botting related activities since February
  • 5377 account bans for account hacking since February

Arguing that CCP is not paying any attention to botting and ISK selling is rather difficult when the security team is banning over 4000 accounts every month.


Getting the ban numbers helps fill in the picture of what happened concerning the black market. For example, from the day after Fanfest to 15 July, the 7-day moving average for the price of ISK on Player Auctions rose from $4.32/billion to $6.00/billion, an increase of 38.9%. How much was due to CCP actions vs. the actions of players impacting the activities of bots? The ban numbers suggests the enforcement activity played a large role.

The first major security-related event concerned the implementation of a check of user credentials against the Pwned Passwords database of compromised passwords. The move toward warning players about compromised credentials is part of the efforts, along with encouraging two-factor authentication, to reduce the hacking of accounts.

The first post indicating CCP deletes market bots 
Perhaps the most satisfying news came in late May, as a major ban wave hit Tranquility. What made the ban wave different was the treatment of market bots. The botting forums initially were confused, but CCP Peligro made an announcement on Twitter.


The last major event I know of possibly is related to the ban wave that began on 23 May. A Reddit post on 13 June revealed several Chinese corporations, including those in Goonswarm Federation, Test Alliance Please Ignore, Ranger Regiment and Fraternity all suffered massive bans. According to the post, one corporation in Goonswarm had over 200 billion ISK removed from its corporation wallet.

Now, I don't believe that the price hike seen on the black market are solely due to the actions of CCP's security team. Widespread warfare targeting rental alliances can keep ISK sellers from restocking their stores with freshly botted money. Also, outside events like Russia's war on the Telegram Messenger service can disrupt players (and bots) from reaching CCP's servers. But CCP has taken significant action against botters, hackers and ISK sellers since the end of Fanfest and I hope the efforts continue under the new executive producer.

No comments:

Post a Comment