7 ms·

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the r

by xyst 6y ago

This is why I have a separate machine for "gaming" and "work" Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Even with their best efforts, cheaters will still prosper. Might even go a step further and firewall my gaming machine off from the rest of my network.

Guest19023892 6y ago
This is one of the reasons I like gaming on GeForce NOW. I can use my primary laptop, play any game without having to install anything, instantly alt-tab back to the desktop between rounds without any weird bugs or crashes, etc.
invokestatic 6y ago
No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and prone to detection than ReadProcessMemory was before anti-cheats went ring0.
- mhh__ 6y ago
  Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?
  - zinclozenge 6y ago
    I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.
    - EamonnMR 6y ago
      Not really, some anti-cheat analysis is server-side and designed to catch people acting bot-like.
      - Natsu 6y ago
        Yeah, even if someone made a physical robot that did everything, they'd notice when it did stuff like playing for 1,000 hours without ever taking a break or talking to anyone.
        sp0rk 6y ago
        Bots have long been designed to account for these types of checks by having scheduled hours and jittered breaks. Private messages and name mentions can alert the bot owner so they can respond manually. I've even seen bots that will pipe private messages to an IRC channel so that any number of restricted people can respond to the messages. It's been a long time since I've worked with game bots so I'm sure they're even more advanced now.
        Natsu 6y ago
        Yeah, I know it's always an arms race, but the trick is to always give them something they weren't anticipating that's hard to deal with in code. There are always methods that would alert a human to something odd going on that don't alert the bot's methods for perceiving its surroundings. One of the best tricks is to show them messages via a method outside of normal chat which a normal player would see on their screen, but which a bot would not receive as 'chat'.
        squeaky-clean 6y ago
        Just have your bot log off and "sleep" randomly for 4-10 hours every night, and log off for 15 minutes every few hours during the day. If you ever get a private message, have your system play a beep (or ping you on IRC then/Discord nowadays). As for not talking to anyone, a surprising amount of people play MMOs just like that, so it's not really atypical for a player to never communicate. Runescape even has an account choice, "Ironman Mode", where you have to play the game self-sufficiently, and can't trade with or rely on any other players. You can still chat with other players if you want, but you don't have to.
  - tedunangst 6y ago
    A lot of cheats involve reading in memory game state to see through walls, which your screen grabber won't be able to do.
    - charcircuit 6y ago
      You can use DMA to read memory in an undetectable way.
walrus01 6y ago
It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?
- rstat1 6y ago
  In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their products, and are trivially easy to remove once they're no longer needed.
  - philistine 6y ago
    Hopefully, Microsoft is going to follow in Apple's footsteps and close the access to the kernel for any and all programs. Yes, we will lose a lot, since Apple right now cannot cover all use cases of kernel access through new APIs, but we will gain so much in security and reliability. I'm of the opinion that easy kernel access for all apps and games is ultimately not putting me in control of my computer.
    - pjmlp 6y ago
      They already kind of did, I only install PC games via the Windows store.
    - rstat1 6y ago
      Access to kernel mode on Windows is already pretty restricted as it is. As far as I understand, you either have to run your whole machine in a special "Test Mode" or have a specific kind of (expensive) code signing certificate. But beyond that, I don't see how "more restriction" == "more control for the user"
      - ladyanita22 6y ago
fpgaminer 6y ago
This is the way. Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).
- matheusmoreira 6y ago
  > Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Please post details. Were they literally mining user data?
  - fpgaminer 6y ago
    The spyware is called Red Shell and it got packaged with a bunch of popular games. Yes, it mines user data.
    - matheusmoreira 6y ago
      Thanks for the reference.
sseneca 6y ago
> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)
- pstrateman 6y ago
  Your computer is really a bunch of computers pretending to be a single computer. Most of the components have firmware that can itself be loaded with malware.
  - sseneca 6y ago
    Ah. So, if a Windows application runs in ring 0, it can put malware in a place such that it can then interact with the Linux install? Is there _any_ way to bypass this, apart from separate machines? I didn't know this was possible.
    - rincebrain 6y ago
      Theoretically - and vice-versa. Depends on what the avenue of exploit you're worried about is. You can disable BIOS flashing from the OS in the BIOS, but that might still be theoretically vulnerable to, say, compromising the Intel ME environment and flashing from there; a rootkit loaded in SMM could hang around until the machine is cold power cycled (and theoretically compromise the bootloader(s) to load itself and then chainload the "real" bootloader every boot); if you want to get really invasive, you could theoretically start flashing various microcontrollers attached to the system (say, a USB flash drive, or your HDD/SSD controller) to do malicious things. These get increasingly unlikely (and unreliable, without knowing and targeting the specific hardware you're using) as your attacker model includes less resources, but not impossible. Intel ME code execution, BIOS and SMM rootkits, malicious USB flash drive firmware and HDD firmware have all been demonstrated (I haven't seen malicious SSD firmware, but there's nothing theoretically stopping it other than the controller doing a lot more on them), and a couple have even been found in the wild.
    - 120391583 6y ago
JUNGLEISMASSIVE 6y ago
I hope those separate machines are also on separate network segments without a route in between.
matheusmoreira 6y ago
Game companies literally think they have the right to own your machine. This is the kind of garbage they force gamers to install on their machines: https://www.theregister.com/2016/09/23/capcom_street_fighter_v/ https://www.theregister.com/2016/09/23/capcom_street_fighter... https://mobile.twitter.com/TheWack0lian/status/779397840762245124 https://mobile.twitter.com/TheWack0lian/status/7793978407622... Their software also takes screen shots, walks the file system, scans people's processes... Any similarities to malware may or may not be mere coincidences. They're also known for false positives: banning people for receiving special strings via text message, unknowingly installing mods with hacks bundled in or due to the presence of development tools such as debuggers or even virtual machines. Good luck trying to reverse such a ban, the entire gaming community has already been conditioned to accept any decision as final and to even defend this practice. When coupled with DRM, this essentially means your license to play the game has been revoked with no refunds.

by xyst 6y ago

Guest19023892 6y ago

This is one of the reasons I like gaming on GeForce NOW. I can use my primary laptop, play any game without having to install anything, instantly alt-tab back to the desktop between rounds without any weird bugs or crashes, etc.

invokestatic 6y ago

No, anti-cheats in ring0 haven't eliminated cheaters, but that was never the point. The point is to make it more difficult to cheat. And they have succeeded in that. Check any cheat forum like unknowncheats. You'll see that most hackers now have to chain multiple (complex) exploits together to get their cheats working, only to get it patched by the anti-cheats a few days/weeks later. This is way more difficult and prone to detection than ReadProcessMemory was before anti-cheats went ring0.

mhh__ 6y ago
Surely the end state is cheats that even ring0 can't see i.e. read the display directly, act through the mouse. Maybe we should we run the entire OS in the games hypervisor?
- zinclozenge 6y ago
  I was actually thinking that you should be able to build a bot for MMOs and other kind of games that require farming with a raspberry pi or arduino acting like a mouse with a camera for image recognition. Don't know how feasible that is, but that would be undetectable by anti-cheat software.
  - EamonnMR 6y ago
    Not really, some anti-cheat analysis is server-side and designed to catch people acting bot-like.
    - Natsu 6y ago
      Yeah, even if someone made a physical robot that did everything, they'd notice when it did stuff like playing for 1,000 hours without ever taking a break or talking to anyone.
      - sp0rk 6y ago
        Bots have long been designed to account for these types of checks by having scheduled hours and jittered breaks. Private messages and name mentions can alert the bot owner so they can respond manually. I've even seen bots that will pipe private messages to an IRC channel so that any number of restricted people can respond to the messages. It's been a long time since I've worked with game bots so I'm sure they're even more advanced now.
        Natsu 6y ago
        Yeah, I know it's always an arms race, but the trick is to always give them something they weren't anticipating that's hard to deal with in code. There are always methods that would alert a human to something odd going on that don't alert the bot's methods for perceiving its surroundings. One of the best tricks is to show them messages via a method outside of normal chat which a normal player would see on their screen, but which a bot would not receive as 'chat'.
      - squeaky-clean 6y ago
        Just have your bot log off and "sleep" randomly for 4-10 hours every night, and log off for 15 minutes every few hours during the day. If you ever get a private message, have your system play a beep (or ping you on IRC then/Discord nowadays). As for not talking to anyone, a surprising amount of people play MMOs just like that, so it's not really atypical for a player to never communicate. Runescape even has an account choice, "Ironman Mode", where you have to play the game self-sufficiently, and can't trade with or rely on any other players. You can still chat with other players if you want, but you don't have to.
- tedunangst 6y ago
  A lot of cheats involve reading in memory game state to see through walls, which your screen grabber won't be able to do.
  - charcircuit 6y ago
    You can use DMA to read memory in an undetectable way.

walrus01 6y ago

It seems that a lot of people forgot about things like sony installing rootkits on peoples' PCs. Now it's accepted for gaming anti cheat software?

rstat1 6y ago
In my mind there's a huge difference between the 2. The sony rootkit was installed in secret, full of security holes, hard to remove, and made by a vendor that appeared to give 0 shits about said security holes. All of the anti-cheat solutions I've seen that run in kernel mode are none of those things. They make it well known that they're installing, are made by vendors that actively care about the security of their products, and are trivially easy to remove once they're no longer needed.
- philistine 6y ago
  Hopefully, Microsoft is going to follow in Apple's footsteps and close the access to the kernel for any and all programs. Yes, we will lose a lot, since Apple right now cannot cover all use cases of kernel access through new APIs, but we will gain so much in security and reliability. I'm of the opinion that easy kernel access for all apps and games is ultimately not putting me in control of my computer.
  - pjmlp 6y ago
    They already kind of did, I only install PC games via the Windows store.
  - rstat1 6y ago
    Access to kernel mode on Windows is already pretty restricted as it is. As far as I understand, you either have to run your whole machine in a special "Test Mode" or have a specific kind of (expensive) code signing certificate. But beyond that, I don't see how "more restriction" == "more control for the user"
    - ladyanita22 6y ago

fpgaminer 6y ago

This is the way. Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Kerbal Space Program was infamous for this (they removed the spyware at some point but I haven't checked recently if it was ever added back in).

matheusmoreira 6y ago
> Many games package in outright spyware that siphon all kinds of data off your machine including browsing history. Please post details. Were they literally mining user data?
- fpgaminer 6y ago
  The spyware is called Red Shell and it got packaged with a bunch of popular games. Yes, it mines user data.
  - matheusmoreira 6y ago
    Thanks for the reference.

sseneca 6y ago

> Some game companies (riot games) even install their anti-cheat software so that is loads in the ring 0 space. Why are separate machines required, rather than dual-booting? (i.e. Windows for games, Linux for everything else)

pstrateman 6y ago
Your computer is really a bunch of computers pretending to be a single computer. Most of the components have firmware that can itself be loaded with malware.
- sseneca 6y ago
  Ah. So, if a Windows application runs in ring 0, it can put malware in a place such that it can then interact with the Linux install? Is there _any_ way to bypass this, apart from separate machines? I didn't know this was possible.
  - rincebrain 6y ago
    Theoretically - and vice-versa. Depends on what the avenue of exploit you're worried about is. You can disable BIOS flashing from the OS in the BIOS, but that might still be theoretically vulnerable to, say, compromising the Intel ME environment and flashing from there; a rootkit loaded in SMM could hang around until the machine is cold power cycled (and theoretically compromise the bootloader(s) to load itself and then chainload the "real" bootloader every boot); if you want to get really invasive, you could theoretically start flashing various microcontrollers attached to the system (say, a USB flash drive, or your HDD/SSD controller) to do malicious things. These get increasingly unlikely (and unreliable, without knowing and targeting the specific hardware you're using) as your attacker model includes less resources, but not impossible. Intel ME code execution, BIOS and SMM rootkits, malicious USB flash drive firmware and HDD firmware have all been demonstrated (I haven't seen malicious SSD firmware, but there's nothing theoretically stopping it other than the controller doing a lot more on them), and a couple have even been found in the wild.
  - 120391583 6y ago

JUNGLEISMASSIVE 6y ago

I hope those separate machines are also on separate network segments without a route in between.

matheusmoreira 6y ago

Game companies literally think they have the right to own your machine. This is the kind of garbage they force gamers to install on their machines: https://www.theregister.com/2016/09/23/capcom_street_fighter_v/ https://www.theregister.com/2016/09/23/capcom_street_fighter... https://mobile.twitter.com/TheWack0lian/status/779397840762245124 https://mobile.twitter.com/TheWack0lian/status/7793978407622... Their software also takes screen shots, walks the file system, scans people's processes... Any similarities to malware may or may not be mere coincidences. They're also known for false positives: banning people for receiving special strings via text message, unknowingly installing mods with hacks bundled in or due to the presence of development tools such as debuggers or even virtual machines. Good luck trying to reverse such a ban, the entire gaming community has already been conditioned to accept any decision as final and to even defend this practice. When coupled with DRM, this essentially means your license to play the game has been revoked with no refunds.