12 ms·

What permissions does this require? A kernel module? Something that watches all processes all the time? Messes with input settings or breaks assistive devices

by zdw 5y ago

What permissions does this require? A kernel module? Something that watches all processes all the time? Messes with input settings or breaks assistive devices? On windows, a lot of the actions that "anti-cheat" software takes is indistinguishable from a rootkit.

judge2020 5y ago
Arguably necessary when cheats people install themselves are actual rootkits.
- 10000truths 5y ago
  Not 'arguably necessary'. Cheats can just as easily be detected from the server side through statistical analysis.
  - gruez 5y ago
    That can only detect obvious hacking. Subtle hacking is hard enough to detect that you'd either have to accept high amounts of false positives or false negatives.
    - AmericanChopper 5y ago
      Eliminating obvious hacking would be an improvement in a lot of games. You can get good enough to outplay a waller with a subtle aimbot, especially considering the cheaters are typically not very good at the game. The “rage hacks” offer no level of counter play at all.
  - shreddit 5y ago
    That so called “guessing” has an awful amount of false positives
  - ketralnis 5y ago
    Oh great, so you've solved the problem then. The entire industry just hasn't discovered your one simple trick. You should let them know.
    - pstrateman 5y ago
      Yeah except he's right, the vast majority of cheaters can be detected server side. Literally no game does this, because ?????
      - nightowl_games 5y ago
        Sounds like a startup opportunity. Lookin' forward to the pitch deck!
        TillE 5y ago
        What kind of massive startup ROI are you expecting to make from a highly niche bit of middleware? Just because something is possible doesn't make it profitable.
        pstrateman 5y ago
        Worse the game publishers make more money from cheaters than from legit players. Cheaters have to keep re-buying the game when they get banned. The incentives are for publishers to ban cheaters... but not too fast... and that's exactly what we see happening in practice. Kinda interesting huh
        esyir 5y ago
        I doubt it. Especially since the games where cheaters are most rampant are f2p.
        fletchowns 5y ago
        Video game industry is massive, and cheating is rampant and ruining peoples experience in game. I don't think it's the craziest idea
  - nx7487 5y ago
    Client-side analysis allows the game to identify unauthorized access to game state, which is the root cause of most cheating (probably not going to prevent computer vision aimbots that just analyze frames). It's just a much simpler and effective solution than fine-tuning a statistical model.
    - 10000truths 5y ago
      If it's running on the client, it can be patched out. Any checks done on the client side can be bypassed. Sure, obfuscation will deter most people from trying to reverse engineer the checks, but all it takes is one person to succeed and distribute their cheat program to others.
  - babypuncher 5y ago
    I think if this were true, somebody would have successfully done it by now.
- pstrateman 5y ago
  Sure except EAC doesn't work, even on windows with the full kernel rootkit installed. Money back guarantee SaaS cheats are like $10/month that are undetected by EAC.
  - AustinDev 5y ago
    And those aren't even cheaters using a full DMA module and separate PC which is nearly impossible to detect if done properly.
    - temporarrry0923 5y ago
      Or worse machine-learning-to-bounding-box that takes the video stream through HDMI, identifies character heads, intercepts the USB HID mouse, and injects movement commands to move the center of the screen towards the nearest "head". Literally (not nearly) impossible to detect, there is no difference between this and just aiming by hand. The video is already out of the box, and the USB HID packets look the same as the real mouse's commands. I spent about two months creating training data for this and it now runs smoothly on a sister PC with a capture card. I gave up because I got bored (and perhaps felt guilty about cheating) but I wholeheartedly believe I could have played top 500 region online matches and gotten away with it, as investigations usually trigger manual DMA checks by ESEA/Faceit mods, and a manual ("automated") ban in that case. But there is no DMA in my setup. The only way to get banned would be to play stupidly and obviously cheat, and to be honest that's a plus of my setup: the neural network is not perfect, so the aimbot can't be perfect. Like a built-in humanizer.
      - cooljacob204 5y ago
        To be honest I have completely given up on competitive fps games. The cheating situation has only gotten worse and I really don't see anti-cheat makers winning.
        temporarrry0923 5y ago
        I wish I could reply to this with a rallying cry for you to keep trying. But it's true, every 14 year old kid with a keyboard can cheat in competitive now.
- Razengan 5y ago
  > cheats people install themselves are actual rootkits. reply Examples? That’s like the “Apple shouldn’t allow third-party stores because of malware” argument.
  - sascha_sl 5y ago
    Vanguard blocked some tools that had easily exploitable kernel modules at the start because people were using them to get cheats into kernel mode.
- tablespoon 5y ago
  > Arguably necessary when cheats people install themselves are actual rootkits. There's a hardware cheat that's actually in the wild that uses a capture card, computer vision, and hardware input devices to run entirely outside the OS: https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-computer-vision-auto-aim-that-works-on-any-game/ https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-...
  - rcoveson 5y ago
    With all my heart, I'm rooting for the authors of this approach. Anti-cheat and DRM hide behind the defense of practicality and cost efficiency, but these products are absolutely evil. As personal computers are becoming more and more an extension of our bodies and minds, it is essential that they act in our interests and nobody else's. Imagine a prosthetic leg that phoned the insurance company if it detected illegal drugs in your blood. That's how I feel about these rootkit anti-cheats. So please, let the cheaters turn to human-interface cheating methods. Force companies to deal with these problems in the proper way, like any other security problem: Don't trust the client at all. Infecting the client with your own agents is not an option. Can't make it work? Then use a different business model. Have your users put time and money into the game, and require more time and money the higher up the ranked ladder they climb. If they're buying as many in-game cosmetics as the average user, and playing for as much time as the average user must to reach a given level, then they never notice. If not, don't let them climb the ladder until they do. If they get reported by other players as cheaters, and manual validation confirms it, then they lose their investment. With that approach, you could have the most obviously hacked account in the world and it wouldn't be able to impact anybody for long without covering the costs of its own detection and banning.
    - thirtyseven 5y ago
      Not a game dev but I don't think that's really feasible in a world where network latency is a thing, and it's necessary to send game state to a client that may not currently be visible on screen, unless you'd like us to move to a Stadia-like model of game streaming and dumb terminals.
- devwastaken 5y ago
  Epics anti cheat doesn't even work. flocks of kids get actual aim bots that epic can't deal with. CSGO anti cheat is yet to be matched in quality because it relies on players and statistics. It turns out that you can't control client software and hardware. Good competitive cheaters use hardware aim assist. Any software you make will be modified. The only way to stop cheaters is math, and people.
  - Kaze404 5y ago
    > The only way to stop cheaters is math, and people. And clever game design
  - raydev 5y ago
    In competitive Fortnite it seems like Epic is quick to permaban cheaters. Personally, in the last year of playing, I'm not sure I've run into more than a couple obvious aimbotters. But I guess Epic has games besides Fortnite.
    - devwastaken 5y ago
      Aimbots are a form of obvious cheat. If anti cheat worked, they wouldn't be possible. The movement of the player input and accuracy is mathematically obvious. The problem is anti cheats aren't designed to prevent cheating, they're designed to sell a product that non programmers want to buy. Same as DRM. Somewhere down the list is actually having the anti cheat work, it's not the main goal.
  - anonymousab 5y ago
    > The only way to stop cheaters is math, and people. People are plenty enough. Let them run their own servers with robust moderation tools and custom software and then the community can deal with cheaters effectively. And false positives can simply find another server, since availability in a popular game will be higher than developer provided servers. Over a decade of locking online gameplay even further behind developer and publisher control has been one of the greatest boons for cheaters.
- adapiz 5y ago
  We need to go deeper! Cheat Makers produce their own kernels that trick the kernel modules by intercepting everything theses modules do. I don't know if there is even cheat software on Linux, but if there's a market, there might be a product.
A4ET8a8uTh0 5y ago
Thank you. This makes me very uneasy. Apart from the obvious, it also potentially makes linux a bigger target by increasing exploitable surface a hacker can hold on to. And I am saying this as a happy proton user.
reanimus 5y ago
I wouldn't be shocked if it used BPF probes or something like that. A kernel module is possible, too, especially if they're targeting Ubuntu with DKMS.
- m4rtink 5y ago
  Good luck getting custom kernel modules working with secure boot.
  - reanimus 5y ago
    I don't know if you're being sincere or just trying to gotcha it, but Ubuntu has had support for this for ages as part of DKMS [0]. It generates a key and registers it with the firmware during setup if secure boot is on, and it signs any modules you build with that key as part of the regular DKMS build. [0] https://wiki.ubuntu.com/UEFI/SecureBoot#MOK_generation_and_signing_process https://wiki.ubuntu.com/UEFI/SecureBoot#MOK_generation_and_s...
phendrenad2 5y ago
The dev page still says "The Anti-Cheat Client interface currently only supports the Windows platform and requires a 64-bit operating system installation. Mac and Linux client support are coming soon." so there's not much info yet. I'm guessing it'll require a specific kernel version and an obfuscated kernel patch that probes everything and calls a web service constantly.
marcodiego 5y ago
Pssst! Don't give them ideas!
Razengan 5y ago
“Think of the cheaters!” is the gaming equivalent of “Think of the children!”
Datenstrom 5y ago
This is why I still use the console model with my gaming PC. It is exclusively for games without exception. I would have it boot directly into steam if I could get steam to boot other games like from Battle Net without so much work.
- rodgerd 5y ago
  > This is why I still use the console model with my gaming PC. I mean this is why I use a console as my first choice gaming platform.
  - Datenstrom 5y ago
    I did that for a long time, but I get a little too into FPS games and playing ranked against people who can see in the dark using game filters, have a high FOV not supported on console, 240FPS, and 1ms input lag I decided to switch. Cheating is a console problem too now that everything is doing crossplay anyway.
- vetinari 5y ago
  You can, actually. Steam can add non-steam games to the library, and also can stream them over Steam link. I've used that to play GoG games on Android TV.
zachmetz 5y ago
Riot games already made this on their game titled "Valorant." It's irritating because you need to restart your pc every time you encounter some of the game's errors.
- phendrenad2 5y ago
  Valorant doesn't have a Linux port, so whatever you're playing is unofficial.

by zdw 5y ago

judge2020 5y ago

Arguably necessary when cheats people install themselves are actual rootkits.

10000truths 5y ago
Not 'arguably necessary'. Cheats can just as easily be detected from the server side through statistical analysis.
- gruez 5y ago
  That can only detect obvious hacking. Subtle hacking is hard enough to detect that you'd either have to accept high amounts of false positives or false negatives.
  - AmericanChopper 5y ago
    Eliminating obvious hacking would be an improvement in a lot of games. You can get good enough to outplay a waller with a subtle aimbot, especially considering the cheaters are typically not very good at the game. The “rage hacks” offer no level of counter play at all.
- shreddit 5y ago
  That so called “guessing” has an awful amount of false positives
- ketralnis 5y ago
  Oh great, so you've solved the problem then. The entire industry just hasn't discovered your one simple trick. You should let them know.
  - pstrateman 5y ago
    Yeah except he's right, the vast majority of cheaters can be detected server side. Literally no game does this, because ?????
    - nightowl_games 5y ago
      Sounds like a startup opportunity. Lookin' forward to the pitch deck!
      - TillE 5y ago
        What kind of massive startup ROI are you expecting to make from a highly niche bit of middleware? Just because something is possible doesn't make it profitable.
        pstrateman 5y ago
        Worse the game publishers make more money from cheaters than from legit players. Cheaters have to keep re-buying the game when they get banned. The incentives are for publishers to ban cheaters... but not too fast... and that's exactly what we see happening in practice. Kinda interesting huh
        esyir 5y ago
        I doubt it. Especially since the games where cheaters are most rampant are f2p.
        fletchowns 5y ago
        Video game industry is massive, and cheating is rampant and ruining peoples experience in game. I don't think it's the craziest idea
- nx7487 5y ago
  Client-side analysis allows the game to identify unauthorized access to game state, which is the root cause of most cheating (probably not going to prevent computer vision aimbots that just analyze frames). It's just a much simpler and effective solution than fine-tuning a statistical model.
  - 10000truths 5y ago
    If it's running on the client, it can be patched out. Any checks done on the client side can be bypassed. Sure, obfuscation will deter most people from trying to reverse engineer the checks, but all it takes is one person to succeed and distribute their cheat program to others.
- babypuncher 5y ago
  I think if this were true, somebody would have successfully done it by now.
pstrateman 5y ago
Sure except EAC doesn't work, even on windows with the full kernel rootkit installed. Money back guarantee SaaS cheats are like $10/month that are undetected by EAC.
- AustinDev 5y ago
  And those aren't even cheaters using a full DMA module and separate PC which is nearly impossible to detect if done properly.
  - temporarrry0923 5y ago
    Or worse machine-learning-to-bounding-box that takes the video stream through HDMI, identifies character heads, intercepts the USB HID mouse, and injects movement commands to move the center of the screen towards the nearest "head". Literally (not nearly) impossible to detect, there is no difference between this and just aiming by hand. The video is already out of the box, and the USB HID packets look the same as the real mouse's commands. I spent about two months creating training data for this and it now runs smoothly on a sister PC with a capture card. I gave up because I got bored (and perhaps felt guilty about cheating) but I wholeheartedly believe I could have played top 500 region online matches and gotten away with it, as investigations usually trigger manual DMA checks by ESEA/Faceit mods, and a manual ("automated") ban in that case. But there is no DMA in my setup. The only way to get banned would be to play stupidly and obviously cheat, and to be honest that's a plus of my setup: the neural network is not perfect, so the aimbot can't be perfect. Like a built-in humanizer.
    - cooljacob204 5y ago
      To be honest I have completely given up on competitive fps games. The cheating situation has only gotten worse and I really don't see anti-cheat makers winning.
      - temporarrry0923 5y ago
        I wish I could reply to this with a rallying cry for you to keep trying. But it's true, every 14 year old kid with a keyboard can cheat in competitive now.
Razengan 5y ago
> cheats people install themselves are actual rootkits. reply Examples? That’s like the “Apple shouldn’t allow third-party stores because of malware” argument.
- sascha_sl 5y ago
  Vanguard blocked some tools that had easily exploitable kernel modules at the start because people were using them to get cheats into kernel mode.
tablespoon 5y ago
> Arguably necessary when cheats people install themselves are actual rootkits. There's a hardware cheat that's actually in the wild that uses a capture card, computer vision, and hardware input devices to run entirely outside the OS: https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-computer-vision-auto-aim-that-works-on-any-game/ https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-...
- rcoveson 5y ago
  With all my heart, I'm rooting for the authors of this approach. Anti-cheat and DRM hide behind the defense of practicality and cost efficiency, but these products are absolutely evil. As personal computers are becoming more and more an extension of our bodies and minds, it is essential that they act in our interests and nobody else's. Imagine a prosthetic leg that phoned the insurance company if it detected illegal drugs in your blood. That's how I feel about these rootkit anti-cheats. So please, let the cheaters turn to human-interface cheating methods. Force companies to deal with these problems in the proper way, like any other security problem: Don't trust the client at all. Infecting the client with your own agents is not an option. Can't make it work? Then use a different business model. Have your users put time and money into the game, and require more time and money the higher up the ranked ladder they climb. If they're buying as many in-game cosmetics as the average user, and playing for as much time as the average user must to reach a given level, then they never notice. If not, don't let them climb the ladder until they do. If they get reported by other players as cheaters, and manual validation confirms it, then they lose their investment. With that approach, you could have the most obviously hacked account in the world and it wouldn't be able to impact anybody for long without covering the costs of its own detection and banning.
  - thirtyseven 5y ago
    Not a game dev but I don't think that's really feasible in a world where network latency is a thing, and it's necessary to send game state to a client that may not currently be visible on screen, unless you'd like us to move to a Stadia-like model of game streaming and dumb terminals.
devwastaken 5y ago
Epics anti cheat doesn't even work. flocks of kids get actual aim bots that epic can't deal with. CSGO anti cheat is yet to be matched in quality because it relies on players and statistics. It turns out that you can't control client software and hardware. Good competitive cheaters use hardware aim assist. Any software you make will be modified. The only way to stop cheaters is math, and people.
- Kaze404 5y ago
  > The only way to stop cheaters is math, and people. And clever game design
- raydev 5y ago
  In competitive Fortnite it seems like Epic is quick to permaban cheaters. Personally, in the last year of playing, I'm not sure I've run into more than a couple obvious aimbotters. But I guess Epic has games besides Fortnite.
  - devwastaken 5y ago
    Aimbots are a form of obvious cheat. If anti cheat worked, they wouldn't be possible. The movement of the player input and accuracy is mathematically obvious. The problem is anti cheats aren't designed to prevent cheating, they're designed to sell a product that non programmers want to buy. Same as DRM. Somewhere down the list is actually having the anti cheat work, it's not the main goal.
- anonymousab 5y ago
  > The only way to stop cheaters is math, and people. People are plenty enough. Let them run their own servers with robust moderation tools and custom software and then the community can deal with cheaters effectively. And false positives can simply find another server, since availability in a popular game will be higher than developer provided servers. Over a decade of locking online gameplay even further behind developer and publisher control has been one of the greatest boons for cheaters.
adapiz 5y ago
We need to go deeper! Cheat Makers produce their own kernels that trick the kernel modules by intercepting everything theses modules do. I don't know if there is even cheat software on Linux, but if there's a market, there might be a product.

A4ET8a8uTh0 5y ago

Thank you. This makes me very uneasy. Apart from the obvious, it also potentially makes linux a bigger target by increasing exploitable surface a hacker can hold on to. And I am saying this as a happy proton user.

reanimus 5y ago

I wouldn't be shocked if it used BPF probes or something like that. A kernel module is possible, too, especially if they're targeting Ubuntu with DKMS.

m4rtink 5y ago
Good luck getting custom kernel modules working with secure boot.
- reanimus 5y ago
  I don't know if you're being sincere or just trying to gotcha it, but Ubuntu has had support for this for ages as part of DKMS [0]. It generates a key and registers it with the firmware during setup if secure boot is on, and it signs any modules you build with that key as part of the regular DKMS build. [0] https://wiki.ubuntu.com/UEFI/SecureBoot#MOK_generation_and_signing_process https://wiki.ubuntu.com/UEFI/SecureBoot#MOK_generation_and_s...

phendrenad2 5y ago

The dev page still says "The Anti-Cheat Client interface currently only supports the Windows platform and requires a 64-bit operating system installation. Mac and Linux client support are coming soon." so there's not much info yet. I'm guessing it'll require a specific kernel version and an obfuscated kernel patch that probes everything and calls a web service constantly.

marcodiego 5y ago

Pssst! Don't give them ideas!

Razengan 5y ago

“Think of the cheaters!” is the gaming equivalent of “Think of the children!”

Datenstrom 5y ago

This is why I still use the console model with my gaming PC. It is exclusively for games without exception. I would have it boot directly into steam if I could get steam to boot other games like from Battle Net without so much work.

rodgerd 5y ago
> This is why I still use the console model with my gaming PC. I mean this is why I use a console as my first choice gaming platform.
- Datenstrom 5y ago
  I did that for a long time, but I get a little too into FPS games and playing ranked against people who can see in the dark using game filters, have a high FOV not supported on console, 240FPS, and 1ms input lag I decided to switch. Cheating is a console problem too now that everything is doing crossplay anyway.
vetinari 5y ago
You can, actually. Steam can add non-steam games to the library, and also can stream them over Steam link. I've used that to play GoG games on Android TV.

zachmetz 5y ago

Riot games already made this on their game titled "Valorant." It's irritating because you need to restart your pc every time you encounter some of the game's errors.

phendrenad2 5y ago
Valorant doesn't have a Linux port, so whatever you're playing is unofficial.