5 ms·
I find it interesting that in their "Should I panic" section, they miss one of the biggest panic-inducing points for me: That a program running in ring 0 has so
by TheCraiggers 6y ago
I find it interesting that in their "Should I panic" section, they miss one of the biggest panic-inducing points for me: That a program running in ring 0 has some form of internet access.
They don't go into detail here about how far this goes, but I wouldn't be at all surprised to hear that it is directly sending and receiving data from the internet. That is such a bad idea for obvious reasons.
- kalium_xyz 6y agoI believe its only there because of the kernel panic pun.
- TheCraiggers 6y agoNo, I'm pretty sure it's there because installing something that runs at ring 0 can do anything on your system. Look at all your internet traffic, files, make you go bald, etc. Any sane security-minded person should slightly panic IMHO.
- AdamJacobMuller 6y agoOr just run games on a computer dedicated to the task.
- 0_gravitas 6y agoOf course you understand that that is not a reasonable solution.
- jarfil 6y agoThere are gaming consoles, or you can just not run their games, it's not like there aren't literally thousands to choose from. They're also just games, cheating is not a life or death thing, or it shouldn't be. Alternatively, you could stream a game from a remote server like on Stadia. These anti-cheat systems are only for online games anyway, and you can let Google deal with their kernel driver.
- foota 6y agoCan't you just run two oses alongside each other?
- AdamJacobMuller 6y ago"annoying" when dealing with graphics cards / passthrough if you're talking about virtualization and probably would not be allowed since the hypervisor would be a ring above the kernel module, effectively neutering it. If you mean dual-boot, sure, that's a very reasonable solution as well. I just don't like to reboot often and would personally have a 2nd computer as it probably takes me an hour or more to go from "booted" to "productive"
- AdamJacobMuller 6y agoI didn't write a comment suggesting a thing because I considered it unreasonable and on reflection, no, I don't think it's unreasonable.
- danielhlockard 6y agoThey delegate to a userland process for most things and apparently have had multiple audits on this driver, according to what they've said about the same thing that they run in their game Valorant.
- jandrese 6y ago"Multiple audits" from Gus over in QA to Bob in accounting. Despite all of their assurances I can't help but to feel that it is only a matter of time until this is exploited.
- sincerely 6y agoSo are you accusing them of lying when they say they've had external security audits done, or are you commenting without any knowledge of the topic at hand?
- jandrese 6y agoI'm taking their claims with a large dose of salt.
- anonymousab 6y agoWithout external confirmation from the firms that did the audit and the details of them, you can trust riot's statements about audits no further than you can trust any of their other statements.
- icarus_camp 6y agoI did a security audit last week, which was mostly the managers writing a runbook for weaseling out way out of trouble if a data breach happened. Actually looking at overall system architecture, the specific encryption services, etc was not a popular topic. So yeah audit does not fill me with confidence.
- united893 6y agoWhy would they do that? They don't need to send the data through the kernel, they can just IPC it to the process and use the existing telemetry stack. Also, what gives you panic here? What more damage can they do than running in user mode? They can already access all your files, steal all your cookies etc.
- zeusk 6y agowell because if an attack vector is found in their anti-cheat driver, attackers could use it to access memory space of other processes and not just user accessible files or launch a privileged process for keeping tab on your system.