Some of the exploits, particularly the ones involving local data
display such as weather and mob locations, have no really good
solution. Once it's on the local host, the host owner can do pretty
much anything with the data.  Any bit of code can arbitrarily sit
between the EQ client and the 3D hardware abstraction layer, in this
case the Direct3D API, altering visual data such as models, fog,
environment effects, etc. The solution here is to talk directly to the
hardware, but that's not only highly undesireable, it's highly
impractical and is still susceptibl to man-in-the-middle software
written to sit between the client and the hardware on the hardware's
behalf performing the same exploit. Other locally accessible data
include mob locations, since the client needs to know this to properly
place mobs on the screen, and any hand-held objects which might alter
the appearance of said mob. Basically, anything client-side is knowable
and alterable.

Other exploits are so deeply entrenched in the game's architecture as
to involve some unwieldly rewrites. A good example would be the warping
exploit. Due to hardware restrictions of the day, Verant relegated
movement calculations to the client without any sort of sanity checks
on the server side. As a result, you can have man-in-the-middle network
exploits with software designed to read the EQ UDP packets, interpret
them, parse for desired data, alter said data, then re-insert the
packet into the stream. This can also be used to strip data such as
weather from even reaching the client, so the client never knows about
certain effects.

The solution is a complete rewrite of how the game works, and what data
the client sees. Such a monsterous task would be highly impractical and
at this point even undesireable. Instead, best thing to do would be
take the lessons learned, hunt down cheaters for the remaining life of
the game, and make the next one better.

Solutions/lessons learned:
* Don't give the client authoratative power over anything. You can
relegate certain calculations to the client, but when you do, please,
please, PLEASE implement at least some sort of sanity check on the
server side.

* Use discrete zones instead of monolithic ones (thanks guys, for
giving me a technical name for that). You not only eliminate zone times
and give a more fluid and consistent experience in the game, you
eliminate the need to know where all things are at all times on the
client side. Only things which are close are known about. This reduces
client-side data mining

* Use a strong encryption for pakets. This does two things: increases
network traffic security to prevent unwanted third parties from
sniffing your traffic, and makes man-in-the-middle packet altering
attacks/cheats less likely.

I'm sure there's more, but I can't think of them right now. For now,
with WoW being the big boy on the street, EQ exploiters seem to have
been on the decline; where's the bragging rights in it?
--
Xiphos - I mean, come on, hacking EQ? That's like bragging about taking
down an unpatched Windows 95 box. It's just emberassing. ... ...not
that I would know anything about that sort of thing...