5 ms·
Anti-Cheat Kernel Driver
- Analemma_ 7y agoI'd really rather this sort of thing came directly from Microsoft. They're not perfect, but I definitely trust them more than Riot to not create a bunch of security vulnerabilities or spy on all my active processes. Plus, if people are signing kernel extensions who shouldn't be, isn't that a concern for Microsoft in and of itself?
- SlowRobotAhead 7y agoMicrosoft has a locked down kernel for gaming already. It’s called Xbox.
- kllrnohj 7y agoMicrosoft also releases games on Windows, though, and also has the cheater problem in them. It is still odd that in all their gaming pushes on windows with things like the Windows 10 Game Mode ( https://support.microsoft.com/en-us/help/4028293/windows-using-game-mode-on-your-pc https://support.microsoft.com/en-us/help/4028293/windows-usi... ) that they haven't just made this a "thing" yet. Have a flag or some way for an application to signal that they want their memory actually restricted. You'd at least stop all user-mode cheats overnight, and can also attempt to impose restrictions on kernel-mode drivers. Or let a game know if there's unsigned drivers installed, and let the game segment off that user population. But I guess they won't do anything about this until someone's kernel-level driver anti-cheat becomes a PR disaster for Microsoft. The same way they didn't do anything about anti-virus protection out of the box until McAfee & Norton went off the deep end and contributed to the constant perception of Window's horrible slowness.
- vbezhenar 7y agoHuh, time to uninstall LoL I guess.
- volak 7y agoNew counter strike ish game Valorant also just confirmed a similar anti-cheat system driver https://old.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_starts_upon_computer_boot/fn6yqbe/ https://old.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_...
- SlowRobotAhead 7y agoChinese backed development of a rootkit people willing install, what could go wrong!?
- Operyl 7y agoIt’s not similar, it’s the same in the end. They’re both Riot games and they plan to be moved under the same umbrella.
- alfu 7y agoFrom the same company (Riot games)
- droobles 7y agoI really like the writing style of this, drives the point to non-techies.
- deleted 7y ago[deleted]
- Ygg2 7y agoDoes it recommend them to never install this piece of crap? It's already been defeated, and it's not like LoL didn't have a crypto miner before.
- Pfhreak 7y agoDoes it? I think it comes off as extremely patronizing. To each their own, I suppose.
- duskwuff 7y agoI came to the same conclusion. The tone is incredibly condescending, and there's very little technical substance to the article. (As mjg59 pointed out [1], the Wikipedia infographic they used -- without attribution! -- even implies that drivers run in Ring 1 or 2, which is only true if you're running OS/2.) [1]: https://twitter.com/mjg59/status/1249962092850900992 https://twitter.com/mjg59/status/1249962092850900992
- kalium_xyz 7y agoThe real question is, where does rito hire from?
- bmn__ 7y agoI'm under the impression they have lots of hires from the fanbase. https://tvtropes.org/pmwiki/pmwiki.php/Main/PromotedFanboy https://tvtropes.org/pmwiki/pmwiki.php/Main/PromotedFanboy
- VWWHFSfQ 7y agoriots games will start shipping with a rootkit or you can't play
- ewired 7y agoThey named this blog post after a component of Unix/Linux (/dev/null); ironically, it doesn't look like their games will ever be available for macOS or Linux, especially when they're doing something like this.
- danielhlockard 7y agoKernels are still things on MacOS and Windows.
- Pfhreak 7y agoThe full title starts with "/dev/null", which I don't believe is a thing in Windows?
- kalium_xyz 7y agoIts an expression for binning something rather than a technical component. However if you want to argue technicalities /dev/null is not a thing on linux either unless you have a posix distro, which comes with windows.
- kalium_xyz 7y agoThe nt kernel of windows is a very real component of the OS, which is what they are talking about. Microsoft keeps their low level well hidden though.
- kroltan 7y agoGP was referring to /dev/null in the actual article title (not the HN title)
- jimbob45 7y agoI was more okay when Valve did it years ago because Valve isn’t majority-owned by a scummy Chinese company.
- alunchbox 7y agoOh man, I completely forgot about that. That's a no no from me
- TheCraiggers 7y agoTo my knowledge (and looking online I can't find anything to change this) VAC does not run in ring 0.
- jimbob45 7y agohttps://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/?utm_source=amp&utm_medium=&utm_content=post_body https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an... Here was Valve’s elevator pitch of the situation. If you click the link inside OP, you can crawl down the rabbit hole and literally see the code in question. Again, not Chinese. Fuck China.
- SCdF 7y agoWhat concern do you have because the ethnicity and location of the company is in China? How does that compare to American or five eyes countries, given what we know about those situations? What makes, to you, one a higher threat than the other? Edit: to be clear I'm trying to work out, as someone who is clearly OK contributing and participating in the Chinese economy (gotta get dat new iphone), why is my concern for the morality of the Chinese government in this exact instance higher than, say, the government I actually live under (UK) or their allies (US and the rest of 5 eyes)
- mey 7y agoThe amount of autonomy and legal recourse of a private corporate entity in China compared to the United States. While the US does not have a great track record (Room 641A, National Security Letters, v-chip, putting export controls on strong encryption, etc) entities like the EFF and ACLU, plus corporate entities have successfully and repeatedly pushed back. I am not an expert on Chinese corporate entities, but my anecdotal observations from working in companies with arms in China has been it's always a very careful process to not annoy the government, as it means losing everything with little recourse. Edit: The implication is that, if the government of China, was exceptionally interested placing a backdoor in the software of a Tencent system, they may not be able to reasonably object. Where if the FBI came to Apple, (and we know they have) they can say no. [1] [1] https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI%E2%80%93Apple_encryption_d...
- TheCraiggers 7y agoI find it interesting that in their "Should I panic" section, they miss one of the biggest panic-inducing points for me: That a program running in ring 0 has some form of internet access. They don't go into detail here about how far this goes, but I wouldn't be at all surprised to hear that it is directly sending and receiving data from the internet. That is such a bad idea for obvious reasons.
- kalium_xyz 7y agoI believe its only there because of the kernel panic pun.
- TheCraiggers 7y agoNo, I'm pretty sure it's there because installing something that runs at ring 0 can do anything on your system. Look at all your internet traffic, files, make you go bald, etc. Any sane security-minded person should slightly panic IMHO.
- AdamJacobMuller 7y agoOr just run games on a computer dedicated to the task.
- 0_gravitas 7y agoOf course you understand that that is not a reasonable solution.
- jarfil 7y agoThere are gaming consoles, or you can just not run their games, it's not like there aren't literally thousands to choose from. They're also just games, cheating is not a life or death thing, or it shouldn't be. Alternatively, you could stream a game from a remote server like on Stadia. These anti-cheat systems are only for online games anyway, and you can let Google deal with their kernel driver.
- Pfhreak 7y ago> This isn’t giving us any surveillance capability we didn’t already have. Wait, really? What surveillance capabilities does LoL already have without a kernel driver?
- freeone3000 7y agoThe update process runs as admin, so basically anything.
- trasz 7y agoAnd they can do it without using any GPL-only symbols?
- duskwuff 7y agoWhat GPL symbols? They don't support Linux. Their most popular game (League of Legends) used to be somewhat playable on Linux through WINE, but that was never officially supported. They've banned Linux users on multiple occasions due to false positives in bot/cheat detection (e.g. [1], [2]), and rolling out this anti-cheat driver is likely to make Linux play completely impossible. [1]: https://dotesports.com/league-of-legends/news/riot-games-anti-cheat-lol-single-case-exception-players-linux-25056 https://dotesports.com/league-of-legends/news/riot-games-ant... [2]: https://www.reddit.com/r/leagueoflinux/comments/8pag4y/banned_for_scriptingrunning_game_through_wine_on/ https://www.reddit.com/r/leagueoflinux/comments/8pag4y/banne...
- SlowRobotAhead 7y agoUnder why you shouldn’t panic: > This isn’t even news. Several third party anti-cheat systems— [install kernel drivers] Is there is a different in a rootkit and kernel driver? I think so.
- diebeforei485 7y agoSigh... As annoying as MacOS is, I find myself reassured every now and then that Windows is worse.
- deleted 7y ago[deleted]
- GoOnThenDoTell 7y agoI’m surprised Microsoft allows this
- icarus_camp 7y agoMicrosoft tried to put a stop to this in Vista, with having a very proactive UAC permissions popup. Folks hated it.
- lostmsu 7y agoMicrosoft can still revoke the driver signing certificate, and disallow this purpose in the future. I think that would be a good move.
- ungzd 7y agoLinked article about DMA-based cheats is even more interesting: https://blog.esea.net/esea-hardware-cheats/ https://blog.esea.net/esea-hardware-cheats/
- verall 7y agoWow that's a shite article. It starts with "This post is kinda tech-heavy" and then never gets tech heavy. The "I think I'm going to panic" section is super condescending. It obviously does give surveillance capabilities it didn't previously have: I could previously disallowed the user that was running a game from viewing a file, and Windows would respect that. The game might crash, but it would not have accessed the file. They are being directly misleading in the article and trying to use technical terms to confuse people. Ick.
- anonymousab 7y agoYeah. I'd question the motivation of any explanation that obscures the "yes, it does enable all of those BadThings but we promise to do our best not to exploit them and here's why we can be trusted" truth of the matter. That said, they're writing for multiple gun-jumpy audiences so I don't think they lose all of the benefit of the doubt here. Just that this isn't good enough at the moment/yet.
- icarus_camp 7y agoI wonder how this will play our on the OS X version of LoL. Apple straight killed that Zoom webserver awhile back with an OS update. I wonder if they make a similar move here against Kernel Level anti cheat? Assuming you even pull it off on OS X.
- duskwuff 7y ago> Assuming you even pull it off on OS X. Doubtful. Apple has generally been ratcheting up restrictions on kernel extensions [1] -- currently, kernel extensions must be signed with a developer certificate that has explicit entitlements for kernel extensions, and must be explicitly approved by the user in security settings. [2] A normal Apple developer certificate is not sufficient to sign a kernel extension, and Apple has signalled that they intend to end all support for loadable kernel extensions in the future. [1]: https://developer.apple.com/support/kernel-extensions/ https://developer.apple.com/support/kernel-extensions/ [2]: https://developer.apple.com/library/archive/technotes/tn2459/_index.html https://developer.apple.com/library/archive/technotes/tn2459...
- peter_d_sherman 7y agoCan't the cheaters just get their own server, and the people who want to play fairly just get their own server?
- breischl 7y agoIf everyone is cheating, then you don't have an advantage, so what's the point? I guess you could look at it as another level of metagame, though.
- peter_d_sherman 7y agoWhy not simply group gamers on different servers depending on how well they're doing or not doing? You win a lot, you get grouped on a server with other winners, you lose a lot, you get grouped on a server with others that lose a lot. This keeps skill levels (and challenge) consistent. Or, is that too much of an algorithmic challenge for the game designers? If they can write the game in the first place, it shouldn't be...
- madjam002 7y agoWhen SR-IOV becomes mainstream do you think it would be a good idea to start virtualising every game in its in sandbox? So each game runs in its own VM and doesn’t have access to the host?
- dang 7y agohttps://news.ycombinator.com/item?id=22855600 https://news.ycombinator.com/item?id=22855600 https://news.ycombinator.com/item?id=22230168 https://news.ycombinator.com/item?id=22230168