25 ms·

Call of Duty Adds Kernel Level Driver for Anti-Cheat

179 points by notbaab 5y ago

gigatexal 5y ago
“ When you shut down Call of Duty: Warzone, the driver turns off.” is that really how drivers work?
- Arnavion 5y ago
  Windows drivers can be loaded and unloaded dynamically, yes. It's also possible that they're using "shut down" semantically and not literally, in that the driver is loaded but inactive while the game isn't running.
  - fuj 5y ago
    Isn't this the case for every major OS? I know FreeBSD device drivers can be (un)loaded on-the-fly. Same for MacOS. I assume it's also possible in Linux(?)
    - kaladin-jasnah 5y ago
      It is. I believe you use modprobe -r kernel_module_name to unload a kernel module and modprobe kernel_module_name to load it.
    - Arnavion 5y ago
      Linux lets you disable dynamic modules. OpenBSD removed support for them some years ago.
    - astrange 5y ago
      macOS doesn't let you load kexts anymore since it's less important with drivers moving to userspace.
- Sohcahtoa82 5y ago
  Yes. Drivers can be loaded and unloaded at will. It's a necessity for USB devices. Heck, these days, even a GPU driver can be hot-swapped.
- schmorptron 5y ago
  They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.
  - novok 5y ago
    What I don't get about this, what prevents your cheats from starting at boot too?
    - schmorptron 5y ago
      I'm not an expert, but from what I've come to understand, anti cheat is for the most part about making it as hard or inconvenient to cheat as possible. You'll never be able to stop it, but putting in hurdles for both the cheat developer and user is key to keeping it limited. The huge problem is that cheaters are very willing to go to extreme lengths of inconvenience or even risk, as in running random cheats as kernel level drivers. So anything that makes the developers have to bypass another hurdle and another component you can patch in your anti cheat "rootkit" gives you a small boost in the cat and mouse game. Your component starting at boot makes it more likely the cheat devs and cheaters will have to do the same and have a more complicated setup.
      - novok 5y ago
        I think making your cheat kernel level is a relatively minor hurdle compared to the lengths that people have been going with ML + hardware based cheats at this point. Maybe we need to stop the kernel anti-cheat just from a pure privacy perspective at this point, or make it an OS service you can implement as a user level module only, much like endpoint management and macOS. I get a feeling there is more to being in the kernel although.
jacquesm 5y ago
Client side security isn't. See also: NFS.
sour-taste 5y ago
I look forward to all the kernel level anti cheat systems interferring with each other and banning players on accident.
- novok 5y ago
  So far I think there is only about 4 or 5, so they probably all talk to each other to prevent this being an issue.
- Teknoman117 5y ago
  Look, Halo MCC can't figure out the difference between you quitting and their game crashing.
jpgvm 5y ago
This is an arms race that game developers won't win, it's just whack-a-mole. They should invest instead in server-side models for detecting cheating, then it can't be circumvented and you don't need to bother learning all the different ways they can produce inhuman inputs.
- Thaxll 5y ago
  "They should invest instead in server-side models for detecting cheating" Which is already the case and can't work for all use cases. how the server knows that you see behind walls exactly? And ML / heuristic stuff is very limited as well. Detecting cheating, client or server side is very complicated and not even close to be a solved problem.
  - DizzyDoo 5y ago
    I once had an unusually good match in a popular FPS game, triggered some statistical tripwire, and received an automatic ban for 48 hours. "Just in case". Streamers and pro-players often have their accounts whitelisted from this system, because it would be laughable to happen publicly and show off just how 'security theater' it truly is.
    - KennyBlanken 5y ago
      Streamers and pros use cheats. Google "streamer caught cheating" and there's page after page of news items about people cheating even in tournaments, while streaming. They're "whitelisted" because the game benefits from streamers who look like they're great at the game, and because competition for pro players is actually fairly stiff (in part because there aren't many pro players, because it's so hard to make money at it...but also because being competitive at a game usually means dedicating your training and play time to that game.) Aim fatigue is a problem for pro players and it usually sets in around an hour or two...so when you see a streamer playing really well hour after hour, they're almost certainly employing some level of cheating. It might be really subtle, they might only 'flip it on' when they really have to. But it's there, and at 30-60fps and stream compression it can be really hard to spot even if you're a seasoned player in the game.
benkkey 5y ago
Now they're applying the same solution as what the Riot Games did to Valorant. It's alarming as the anti-cheat has kernel rights. Well, I hope that after they implement the anti-cheat, the hackers will probably decrease and eventually die down.
AlexandrB 5y ago
The only FPS I play is NS2 and cheating seems like less of a problem than what people are describing in these comments. I wonder if it's because you play on community-run dedicated servers and not some opaque matchmaking system. This allows admins to kick cheaters at their discretion. This is the equivalent of forums vs. Facebook. The moderation on well-run forums is better than what Facebook can offer because it's done by real humans.
nazgulsenpai 5y ago
If anyone here played Modern Warfare 2 on PC when it released, you know this is about 13 years late :) While I don't like kernel level anti-cheat, its hard to disagree that its better than nothing and also hard to deny that cheating in competitive realtime multiplayer PC games isn't a huge problem.
Animats 5y ago
Has Microsoft signed off on the kernel driver? Has it passed Static Driver Verifier? Has any third party inspected the driver for security problems? will the vendor contractually commit to the driver not being a backdoor?
snicker7 5y ago
Things like this is why I increasingly game on consoles.
tibbydudeza 5y ago
Brilliant - game devs doing kernel drivers.
- Underphil 5y ago
  I don't think you realise that many of these companies have large and experienced security engineers and experts who develop these things.
  - saagarjha 5y ago
    Sometimes they do, sometimes they give you kernel r/w ¯\_(ツ)_/¯
  - tibbydudeza 5y ago
    Yes like the infamous day 1 release patches to get a game working - reputation of game devs and studios are that they slap dash testing/coding to make release dates. Cyberpunk 2077 (cough cough).
mauz 5y ago
Aside: are there any good tutorials that provide an overview on how to write such an anti-cheat?
- DizzyDoo 5y ago
  No tutorials to link you to, but there's significant overlap between anti-cheat systems and anti-virus/anti-malware systems, which makes sense when you consider their aims. Searching for academic papers about anti-virus approaches to dealing with networking, memory and filesystems will be helpful.
- jti107 5y ago
  riot had a good white paper on their valorant anticheat and why they designed it to be a kernel level anticheat
dcdc123 5y ago
Huh...that seems a bit excessive.
- edave64 5y ago
  It's the logical conclusion. The clients machine is inherently untrusted. So how do ensure integrity? Best you can do is try to get to try to get as few layers between you and the machine as possible. It's essentially the same problem as DRM, which generelly can only hope to prevent piracy for a few weeks. The solution of the movie industry there was to add there garbage directly to the hardware.
- DizzyDoo 5y ago
  If I write a cheat for your game that operates on the kernel level, how would you detect it from the game that runs in user space?
  - jstanley 5y ago
    You wouldn't. But it's my computer and it's supposed to serve me, not you.
    - deleted 5y ago
      [deleted]
  - bombcar 5y ago
    Next will be cheats that run in hardware themselves ... I wonder if it's possible to flash a video card to force wire framing ...
    - ev1 5y ago
      This is already a thing and somewhat-common, everything from PCIE devices to aimbotters purchasing EV codesigning certs in their own name.
    - sprite 5y ago
      From what I understand there are already cheats that work at the hardware level (read video output, modify mouse input) with all software running on another machine.
judge2020 5y ago
> 3. Protecting Your Privacy. In its initial rollout on Call of Duty: Warzone, the kernel-level driver will only operate when you play on PC. The driver is not always-on. The software turns on when you start Call of Duty: Warzone and shuts down when you close the game. Plus, the kernel-level driver only monitors and reports activity related to Call of Duty. The whole thing is that, if you don't want other kernel drivers touching Windows before yours loads, you have to load yours first (at least, I believe that was a point of contention last time). It'll probably be in the same light as how Riot Vanguard works in that it loads pretty early at boot, but only sends data to the server when you open the game.
q_andrew 5y ago
Not to say this isn't a worrying practice, but it's unfortunately industry standard. Almost every mainstream fps game has intrusive software, to the point where you're expected to be thankful that it's not a rootkit (which is not unheard of).
- mgsk 5y ago
  Then there's CS:GO, whose developers refuse to use intrusive practices to counter cheating. And the game is ruined by rampant cheating. (Neither for nor against. Just saying.)
  - eloisius 5y ago
    It seems like removing incentive beyond trolling is the best solution. Whose spinning up a cluster of bots if you can’t level up and sell digital loot? Market places for digital items has to be the dumbest thing ever in gaming. CS 1.6 was fun and the only thing you could customize was your graffiti spray, and there wasn’t a marketplace for them. You just added an image you liked.
  - tpxl 5y ago
    Then there's PUBG (BattlEye) ruined by rampant cheating. Then there's EFT (BattlEye) ruined by rampant cheating. Then there's (was?) Combat Arms (multiple anti cheats over the years) ruined in-part by rampant cheating. I wouldn't mind _that_ much if anti-cheats actually helped, but they don't.
    - remarkEon 5y ago
      EFT getting ruined by cheating is such a tragedy, too. Most immersive and, well, interesting and unique FPS out there (imo). I still play it though, and only encounter cheaters on certain high loot maps at this point (Reserve and Labs).
    - DizzyDoo 5y ago
      I'm still playing PUBG, though just FPP, and rarely run into what is obviously a cheater - maybe once every two months? But while things have got better, you're right, when things were really, really bad it hurt the game's community terribly. I do think that anti-cheat helps, if the developers are mostly engaged with it, but it's a long fight over a long time. Most of the strategies to do with 'ban waves' - ie, not banning cheaters immediately - are pragmatic concessions to that reality.
brink 5y ago
Probably going to make it proton-incompatible, I'm guessing.
- bitwize 5y ago
  There'll be patches to enable this for Linux soon enough.
  - Thaxll 5y ago
    There is 0 chance of this happening. Anything in kernel won't be working at all, and I'm 100% sure that Activision won't make any effort to make it work on Linux. None of the Kernel anti cheat work without being compatible with Linux which currently none of them are. EAC is supposed to be in the future but I doubt it will work.
    - MrKiwi 5y ago
      EAC already supports Proton, albeit recently, [1] and BattlEye supports Linux and macOS natively already with Proton support in the pipeline [2]. It's not impossible, it's just up to Activision. [1] https://dev.epicgames.com/en-US/news/epic-online-services-launches-anti-cheat-support-for-linux-mac-and-steam-deck https://dev.epicgames.com/en-US/news/epic-online-services-la... [2] https://twitter.com/thebattleye/status/1441477816311291906 https://twitter.com/thebattleye/status/1441477816311291906
      - Thaxll 5y ago
        Except that dev has to opt-in which I'm pretty sure none of the major studios will do, supporting another platform for a very vocal population with a few users.
        benbristow 5y ago
        Activision make a killing from selling DLC & Season Passes from their games like Call of Duty. Not sure why they'd give up free money from a single toggle switch with no extra work. Unless out of spite, like when Snapchat banned third-party clients for Windows Phone (like 6snap) and accounts using it (I'm still raging that my 'benbristow' username got banned and now I'm using 'benbristow1' because of that). Fun fact: The guy that made 6snap (and other 6 prefixed apps like 6tin (Tinder)) (Rudy Huyn) was hired by Microsoft and is now one of the leads behind the updated Windows 11 Store app
rafale 5y ago
Microsoft should implement an Xbox mode for Windows that has these protection features for all games. It will probably require some virtualization and performance degradation but it's better than each game rolling out their own half assed drivers.
- 908B64B197 5y ago
  Ironically, in XBox OS I'm pretty sure there's not a big distinction between usermode and kernel mode.
  - zeusk 5y ago
    There is, it's windows with a different shell since 2013
  - Arainach 5y ago
    Everything is very much separated. It's actually a series of OSes running in a hypervisor. http://meseec.ce.rit.edu/551-projects/fall2016/3-4.pdf http://meseec.ce.rit.edu/551-projects/fall2016/3-4.pdf https://www.youtube.com/watch?v=quLa6kzzra0 https://www.youtube.com/watch?v=quLa6kzzra0 (for software discussion check around the 19:00 mark but the whole talk is incredible)
- VortexDream 5y ago
  How about no? This will just lead these companies to implement anti-cheat to protect the "integrity" of their single player games (and their MTX) as well. Say goodbye to mods and other forms of benign game hacking (particularly hacks that fix games like Dark Souls).
  - divbzero 5y ago
    Would it be in a game company’s interest to implement anti-cheat for single player games? Mods and other forms of benign game hacking increase the popularity and longevity of games which presumably benefit profitability.
VWWHFSfQ 5y ago
It's cheating really that big of a deal? How do they try to stop it now? Do they really need a kernel driver?
- rasz 5y ago
  They need kernel driver because running garbage code on user computers is cheaper than deploying server side user input validation.
- ProAm 5y ago
  It's been really bad in CoD, this has been requested for a while.
- cstrahan 5y ago
  Yeah, it's pretty bad. > How do they try to stop it now? Generally, they don't. They have an in game reporting function, but it doesn't seem to do much good. Many cheaters live stream their exploits, seeing people through walls, getting 100%-accuracy-all-head-shots, etc. The net code that's responsible for reporting where you are aiming is separate from the data/code that reports where your bullets are sent, so some cheaters show off by shoot directly at the ground below their feet while magically killing people several hundred feet up above in a helicopter. The experience is often pretty bad, and yet people still play the game...
- vkou 5y ago
  > It's cheating really that big of a deal? Yes, it makes competitive/casual play crap. In CoD in particular, it is out of control. > How do they try to stop it now? A variety of ways, ranging from server-side analytics, player-driven report systems, manual review, the game inspecting its own state, processes that spy on your computer, and rootkits. Each and every one of these has different advantages and drawbacks. > Do they really need a kernel driver? Given how ineffective anti-cheat efforts in CoD have been, it's possible that they need a kernel driver to bring it under control. It's possible that a more talented team would not.
- DizzyDoo 5y ago
  It's not just a big deal, it's a massive market. There are many people who will pay an enormous amount of money for custom written cheats, there are whole SAAS-style subscription services for different game hacks, it's... all a bit silly. It's when there's a whole cottage industry around this that you know things are out of hand.
Santosh83 5y ago
So the endgame would be a type-1 anti-cheat hypervisor I guess?
- donkarma 5y ago
  nah, you'd just get nested virtualisation cheating hypervisors
  - technick 5y ago
    mind blown
  - temporarrry0923 5y ago
    Yeah I actually almost worked with a ESEA cheat provider that did exactly this. It was a hypervisor that ran the kernel-AC within it. It really subverted my expectations, if you will ;)
MR4D 5y ago
Can anyone tell me why Fortnite doesn't seem to have as bad of a problem as CoD? My son plays both, but CoD really sucks. It is so obvious when someone is cheating.
- justwalt 5y ago
  I think Fortnite uses a projectile bullet model while Call of Duty is all hitscan, but I could be mistaken. It’s been years since I played a CoD game.
  - vesrah 5y ago
    There were bots for Quake 3 Arena that accounted for projectile speed and enemy player movement. I believe Fortnite uses some kind of bloom in accuracy though.
  - echlebek 5y ago
    Call of Duty uses projectile bullet models.
- NtGuy25 5y ago
  Fortnite has a decent anticheat, which also runs in Kernel. The skills to evade a solely usermode monitor isn't that hard, since you can literally just watch api calls and defend against some memory forensics. This is made harder for the cheat dev due to things like Discord running dynamic code, which looks EXACTLY like shellcode/cheat payload. Especially in a world with limited customer support, and even more limited on anyone who can help, false bans are a big concern. DKOM(reading/modifying kernel structures directly) is alot harder to detect, and also alot more undocumented. To the point it takes someone in the field to make a cheat and bypass, vs someone with a decent level of application dev experience. And there's not many Kernel developers, and there's also such a limited amount of forensic/malware analysts that can code anything beyond powershell.
- EastOfTruth 5y ago
  > It is so obvious when someone is cheating. It is not always very obvious, at least on CSGO... there are some experienced/smart cheaters.
jccalhoun 5y ago
Cheaters are going to figure out a way to cheat. Even if it means some kind of TASBot device to physically press the buttons on a controller there will always be a way for someone to cheat.
- mdoms 5y ago
  If we imagine we're in a world where all cheaters are forced to use a physical device to cheat - that's a big win. Sure some people will still cheat but the number of players who would go this far and spend this much to do so would be vanishingly smaller than those who can download some sketchy .exe in an afternoon.
- temporarrry0923 5y ago
  It's not about stopping cheating, it's about stopping the bleeding. Some games have a horrendous cheating problem
- darkcha0s 5y ago
  But you've in a way just defended the move itself. Lots of people will spend 10$ on a .exe which makes them better, less will spend the time and effort to set up a TASBot device.
mdoms 5y ago
Good. It's a never ending arms race but the more developers are doing to make cheating hard the better. Nothing can destroy an online FPS as thoroughly as rampant cheating.
everdrive 5y ago
If this happens enough, then a Windows gaming PC becomes a very expensive console. If all I do on my PC is game, then it doesn't really matter if it's got a rootkit (or kernel-level anti-cheat driver) or not. But, that's an expensive console. $600 - $2,000, depending on how nicely you want to game. A lot of the big popular online game culture really isn't fun anyway, so I'm not sure it's much of a loss.
- npteljes 5y ago
  I already use my Windows system like this. Between the anti-cheats and Microsoft's push for telemetry in Windows, I just don't feel comfortable using my Windows as my own private system. So I don't.
- leshow 5y ago
  2k will barely get a decent video card these days, cards aren't selling at MSRP
  - everdrive 5y ago
    I just got a pretty good low end pre-built PC for ~$600: Nvidia GTX 1650s Ryzen 5 3rd Gen Not amazing by any stretch, but definitely good enough to play most games.
- int_19h 5y ago
  Online gaming doesn't necessarily mean competitive PvP. Co-op tends to be a lot less toxic.
  - everdrive 5y ago
    Indeed, but then there is less need for anti-cheat in co-op.
    - int_19h 5y ago
      That's very true, but once an anti-cheat solution is deployed, it tends to be deployed universally for online gaming. So those who mostly or exclusively play co-op still have to deal with intrusive anti-cheat systems, for no tangible benefit to them.
bee_rider 5y ago
These sorts of things always get circumvented, but I wish the CoD players fun during the 1-2 week gap where the cheaters are still figuring it out. I've actually figured out the permanent solution to cheaters. Oddly enough, I worked it out in Pokemon Unite, which doesn't have a cheating problem as far as I know, but does have items that you can buy to boost your character stats. The solution is easy: play a game with a good ranking system, and don't get too sweaty about the whole thing. People who use non-skill based tools like cheating or paid boosts will shoot right up the rankings and leave you behind to play in peace. If somebody has a cheating tool that is so subtle that they play all the way down at my level, it is arguably not a real help anyway.
- IanSanders 5y ago
  I have a different solution. Shadowban. Let them play against each other and bots. Decrease network performance. In rng based situations, roll low most of the time.
- InitialLastName 5y ago
  Having cheaters go up the rankings will invalidate peoples' internet points though. If developers undermine the perceived value of the Skinner Box rewards, players might disconnect the vacuum hose from their wallets.
- dTal 5y ago
  I agree that going to extraordinary lengths to prevent software augmentation of gameplay is attacking the wrong thing. What does it matter, if people are still having fun? But software augmentation doesn't just improve apparent skill, it can also distort gameplay. What if you're really skilled and you get matched with what amounts to a bot? Even if you're good enough to overcome the bot and win the game, it won't be the game you signed up to play. The real problem here is "annoying play styles", something that humans are capable of indulging in without any software help. This is usually policed - ineffectively - by social pressure ("no camping!"). The real solution is an extension of the ranking system - a reputation system, which tracks sportsmanship. All of these problems ultimately stem from the practice of connecting vast numbers of anonymous strangers with each other - cheatbots simply aren't an issue when you play with your friends. This is a social problem.
RattleyCooper 5y ago
> In its initial rollout on Call of Duty: Warzone, the kernel-level driver will only operate when you play on PC. The driver is not always-on. The software turns on when you start Call of Duty: Warzone and shuts down when you close the game. Oh that's good. > Plus, the kernel-level driver only monitors and reports activity related to Call of Duty. Oh, so in other words it reports everything since any software that might be used to cheat at call of duty is technically related to call of duty... Whenever I see this kind of vague verbiage it's never a surprise when it turns out the people who wrote it chose their words very carefully, to purposefully mislead people. Edit: Oh, and they definitely say they monitor other software "that interacts with call of duty" later in the article.
- Arnavion 5y ago
  You don't really have to put so much effort into dissecting their verbiage. It's guaranteed that any kernel anti-cheat is going to be invasive and inspect everything on the system while looking for cheats.
  - KennyBlanken 5y ago
    No, it's absolutely not guaranteed. Especially in competitive shooters, performance is paramount. They have a strong motivation to only look where they need to. And anti-cheat isn't a money-maker, so they're not going to be spending lots of money storing user data they don't have to. Cheat software has to do things like nose around in the game's memory space that no legitimate program is going to do. It also contains in its memory space keywords common to cheat programs. That sort of search isn't really invasive because generally anti-cheat software when it triggers takes an screenshot, and if you're playing the game, there's nothing personal on the screen. Maybe a process is fingerprinted as a known cheat package. Say your kill to death ratio or hit/miss is unusually good. Or you get reported by a higher than normal number of people. Or a human moderator pushes a request, for whatever reason. Or they get a hit on the 'greps' I mentioned, etc. The goal is to see if you've got a screen overlay that betrays wallhacking (ie "glasswalling") or a cheat system's UI. That's all they care about.
foresto 5y ago
John McDonald did a talk at GDC 2018 about how Valve was starting to integrate deep learning into their server-side cheat detection. IIRC, some of the process was automated, some was player-reported, and some was done through human review. As a gamer averse to both cheating and spyware, I found this very appealing. I wonder how their systems have evolved since then. The original youtube clip (v=ObhK8lUfIlc) has been made private, but I think this is a copy of the same video: https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc
- temporarrry0923 5y ago
  VACnet catches the spinbotters and aimbotters! Actually really good at it too; everyone who did that now just cheats less hard. The biggest problem was: It didn't auto ban, just sent to overwatch (players watch a past game and vote for cheater or not, fully anonymized). This resulted in a massive clog when some guys I knew generated around 10k free steam accounts (with $3.5 of proxies), began queueing a few dozen at a time, rage cheating. A hell of a lot of games can be botted with free accounts and a beefy (server IIRC) rig; I think he told me he had about 100 accounts running normally in 10 separate Competitive games all against his own bots(rendering at 2x2 resolution so it ran okay, with cheats injected). They all got sent to overwatch but because so many games were being put through overwatch, the queue got overloaded. This is called Vertigo boosting, because the bots all queued for Vertigo, an unpopular map, to increase odds that only their own bots would be in the game (and, coincidentally, minimize collateral damage to legitimate players). (though it's normally to rank up accounts, not to spam ow queue) Hi eso :p
  - nwiswell 5y ago
    This is how we end up with kernel level drivers rather than more measured approaches.
    - temporarrry0923 5y ago
      For sure in other games, yeah. Newell is opposed to kernel anti cheats, though, so probably not in CSGO. But other games now look at CSGO and make kernel AC's a selling point (literally Valorant's selling point), so yeah.
remarkEon 5y ago
I'm a little out of my depth on this particular topic. Is it possible to stop this[1] kind of cheat without some kind of hardware verification? [1]https://www.youtube.com/watch?v=revk5r5vqxA https://www.youtube.com/watch?v=revk5r5vqxA
- Kuinox 5y ago
  No, but TPM would allow unavoidable hardware ban. So when someone is caught, with manual review for example, they won't be able to play again on the same hardware.
  - Teknoman117 5y ago
    That, or hackers would just use a TPM compatible device you can reassign the keys on. Not necessarily useful from a security point of view, but would get you around bans by hardware id.
    - no_time 5y ago
      Does not work like that. The keys are signed by the vendor of the hardware. You are essentially paying for the hardware AND the signed keys within it. The server can choose to only trust vendor signed keys.
      - Teknoman117 5y ago
        And how long until one of those vendor keys is compromised? Can't exactly revoke the signed key for everyone's hardware. All it takes is a single malicious actor or nasty breach at one of the issuing companies and it's all over. It doesn't appear to have been a big target thus far, but if we get to the point where companies are perma-banning devices, It's not hard to imagine those becoming target #1 for various blackhat groups.
        no_time 5y ago
        It's probably a similar infra to root CAs that sign TLS keys. I don't recall a root CA compromise in recent memory.
Teknoman117 5y ago
The most annoying one to me is that a bunch of these kernel mode anti-cheat systems also go after the VFIO gamers who don't want to run Windows on bare metal. They consider running Windows in a VM "cheating".
- CodeArtisan 5y ago
  These anti cheats have no other choice than become more and more restrictive to the user. Cloud gaming for everyone coupled to a game controller relying on a secure cryptoprocessor may put a end to cheating in the large.
  - shadilay 5y ago
    It won't. There are already people using AI image recognition running on a separate PC to aimbot.
  - no_time 5y ago
    What's the point of a "secure cryptoprocessor" in a controller when you can de-solder the buttons and trigger them via another MCU? Do you make them like POS terminals that self destruct when they are opened? I can just use a servo to press the buttons. With the release of YOLOv5, the rat race for cheater free games just got even more one sided.
- cotton-cho 5y ago
  You can try this out https://superuser.com/a/1389159 https://superuser.com/a/1389159 I have a similar configuration on my Single GPU passthrough and I am able to play games like Fall Guys that have anti-cheat engine. I also tried some other games and have no issues so far. Lmk if you need more help with setting everything up.
- sapphyrus 5y ago
  The problem is that running Windows in a VM is an easy way of getting around current Anti-Cheat software. You can write a cheat that runs on the host OS and reads/writes game memory by directly accessing the guest memory. Even worse, the guest OS has no real way of detecting if you're doing anything malicious so it kind of just has to assume that you're trying to cheat if you're running a VM.
userbinator 5y ago
It's a cat-and-mouse game, where the mice basically have infinite time to spend on anti-anti-cheat... and dare I say it, countless young people probably got their head start in learning about computers, programming, reverse-engineering, etc. by playing this "meta-game". I know some people who were otherwise completely uninterested in the typical STEM courses at school, but highly skilled at the sort of low-level knowledge required to defeat anti-cheat systems, and thus started their career in software development.
- aejnsn 5y ago
  Hi. Have we met or something?
- 22c 5y ago
  I don't doubt any of that but what I don't understand is where these guys are getting all their accounts from. I feel as though if I were making a hack for a game, I'd get numerous accounts banned in the process (which means needing to buy more and more copies of the game). A youngster getting into reverse engineering surely does not have deep enough pockets to spend several hundreds of dollars on buying the game over and over.
  - lotophage 5y ago
    CoD warzone is free to play. The paid accounts I always assumed were either hacked or bought with stolen credit card numbers.
  - gjs278 5y ago
    CS:GO is free
  - darkwizard42 5y ago
    COD Warzone and a few others in the free to play category are just that... free to play and quite easy to create new accounts for
- difu_disciple 5y ago
  Self-taught but that's how I got started early on https://github.com/cheat-engine/cheat-engine https://github.com/cheat-engine/cheat-engine
lemoncookiechip 5y ago
And it does absolutely nothing to prevent actual cheating (look at Valorant and other games with similar anti-cheat) and adds more fuel to the fire that is privacy concerns.
arbirk 5y ago
On windows kernel level drivers are a small step up from the access games already have. If it makes it easier to detect cheats then I'm all for it. It seems like EAC is going to be the standard for cross game HWID ban list. Again I'm all for it.
pronlover723 5y ago
I just bought Back4Blood ... and then got a refund when I realized it required admin to install kernel level services for DRM. So disappointed as L4D and L4D2 are some of my favorite games ever.
lemoncookiechip 5y ago
While I don't particularly like this sort of anti-cheat, I think we should all be more worried about cloud gaming than anything else. It's been obvious for a while that the big gaming companies have it in mind, and the only reason it isn't as big as it could be, is due to tech limitations FOR NOW. When (not if) cloud gaming truly takes off, and it will, we'll lose any and all control over our games. So long to modding, so long to messing with .ini files to get settings right, no decompiling games, no games preservation... The Netflix model approach, where we don't own anything, we're 100% reliant on them to provide us with the service, where servers can (and do) get shutdown at any moment after X amount of years of support. A world where we don't own the games, just subscription services with extra fees for XP boosters. The ultimate live service game that so many of the big companies love. PS: Also means no more cheating by the standard methods.
- veb 5y ago
  This is kind of already happening with the Xbox Game Pass Ultimate. So you get hundreds of games to play, but you actually don't own any of them. I understand you meant it in a different light but I thought I'd give it a mention.
- xarball 5y ago
  I agree that your point on cloud gaming is probably valid for companies trying to maintain a rigid grip over software piracy when the companies still build things that can be stolen -- But I don't think it's strictly necessary for the development of anti-cheat systems. In the next version of Windows, we're seeing a rapid acceleration in the amount of hardware/software fingerprinting and secure storage going on in home computing, with the introduction of the TPM 2.0 and UEFI requirements. I am almost certain that Microsoft is progressing to be able to sell a completely hardware-protected memory address space to game developers, so that they no longer HAVE to worry about cheating. Because if everything from boot onwards is both signed and supports DRM, it's the perfect place to authenticate everything that happens afterwards. This is interesting in that it will almost certainly lead to an explosion of DRM, DLC, and software sold via subscription models. And while this kind of thing will probably be initially well received by players hoping for decent anti-cheats, it will almost certainly lead to users forfeiting even more control to corporations over the final direction of the software programming. (This kind of control may eat itself alive given enough time; we'll really only know after humanity has already gone that far!)
yjftsjthsd-h 5y ago
Okay, so the policy questions are interesting, but I have a technical question: How are they handling kernel compatibility? Even with DKMS API breakage could be brutal, and Valve supports Arch as a first class target so they can't just stick to a stable/old version (it'd be easy with RHEL and doable with Ubuntu, but Arch?).
- dbaggerman 5y ago
  I was a little confused about this as well - until I realised they don't actually specify that this is the Linux kernel. I suspect what they're talking about here is the Windows kernel.
  - yjftsjthsd-h 5y ago
    Oh. Thanks, I just... I'd heard about folks working on anticheat for Linux, so I just assumed... You're right, though.
- jamesfinlayson 5y ago
  I've heard that Valve's VAC only runs on Windows so maybe they're doing the same thing.
xerxes901 5y ago
The whole "super intrusive anti-cheat" thing is really annoying to me as a non-competitive player, who just plays games like CoD, CS, etc occasionally with friends. And not just academically annoying, but practically too. I used to run Windows virtualised under Linux with a PCIe passthrough GPU. I remember having to re-install windows directly on my machine at a LAN party once because CS:GO couldn't be run in a VM anymore :( I think there's a solution that would let wood-tier players like myself avoid this kind of intrusive software, whilst keeping higher-level play clean though. - Implement server-side anticheat detection, that will ban things that look like bots. As other commenters have noted, bots are indistinguishable from good humans from the outside. So, the server-side detection would ban both bots and good humans - Have _opt-in_ client side anticheat detection. If you have this enabled, then you're exempted from the server-side detection. So, you enable this if you're actually good. Could even make this part of the ranking mechanics. Maybe you _can't_ enable the client-side anticheat until the server-side one thinks you're sus. Then you get prompted to turn on the client-side support and get a cool badge or something.
- simooooo 5y ago
  Why am I not surprised the top comment is complaining that GPU pass through to a VM isn’t supported
- cletus 5y ago
  This isn't a high-level gameplay problem. I'm not sure what you play but in (CoD) Warzone, for example, just based on Twitch streams at least, almost every lobby has one or more cheaters/hackers in it now. This is a bad enough problem that it actually threatens the integrity of the game and the continued support from more casual gamers such as yourself. As for your particular case (running a Windows VM with PCI-e GPU passthrough), that's... such a niche corner case that you're you just don't factor in. We can agree that cheating will never be truly eliminated. It's a question of degree and it requires a multi-level solution ie both client-side and server-side.. The server-side detection has to allow for checking by a human with all that entails. It sounds like this is what they're rolling out with CoD Vanguard (Ricochet). It'll be interesting to see how effective this is. Probably the biggest problem for the likes of Warzone and Fortnite is that the game is free. It means getting banned and having to create a new account is essentially zero cost. What about paid-for and earned cosmetics I hear you ask. Well, those are hacked too so it doesn't really matter.
CivBase 5y ago
I understand the desire for powerful anti-cheat, but this is such an intrusive way go go about it. And it's increasingly pointless since you can't detect cheats which are running on a second PC [0]. Instead, this sounds like a great application for machine learning. Train an algorithm to identify a wide suite of cheats using data passed to the server. It wouldn't work for P2P, but if your competitive matchmaking uses P2P then you have bigger problems. [0] https://www.tomshardware.com/news/impossible-to-detect-cheating-tool https://www.tomshardware.com/news/impossible-to-detect-cheat...
milomilo86 5y ago
Good! I’m tired of getting my ass kicked in COD
lvs 5y ago
Aren't the widely deployed Easy Anti-Cheat and Battleye also using creepy kernel modules?
Flow 5y ago
Client-side anti-cheat is a futile endeavor these days and besides being ineffective probably is user-hostile too. Server-side machine learning is the way to go. Also the server should not send info a legitimate client have no use of.
- tester34 5y ago
  >Server-side machine learning is the way to go. If it has 99% accuracy, then you're banning thousands of players have fun dealing with tickets for them & review process >Also the server should not send info a legitimate client have no use of. do not games send "too much" in order to play around networking constrains?
  - Flow 5y ago
    > If it has 99% accuracy, then you're banning thousands of players Obviously you can't just automatically permaban people if the system is not based on a technical inspection of the player's system. Instead you have to bar them from playing for a few days or so. Even VAC reverses bans sometimes. If you are looking for a perfect solution there will never be one. > do not games send "too much" in order to play around networking constrains? Maybe the newest games does that. CSGO and other popular games send complete positions and what-not to every player.
weq 5y ago
I work in Ed-tech and this conversation is intersting to me because we build anti-cheating into our online assessment platforms.
justinlloyd 5y ago
Client-side anti-cheat is pointless, it just captures the low hanging fruit. Kernel level drivers are also kind of useless, easy to circumvent, easy to reverse engineer. Building a capable computer vision bot that can play World of Warcraft, Diablo and CS:GO is trivially easy to do these days. We're talking a few hundred lines of Python to build a working prototype that will track and kill and take objectives. I have a computer vision Diablo 3 bot of less than 2,000 lines of Python that can run Rifts and and grind high level Grifts with complete success, including boss encounters and adds. My World of Warcraft computer vision bot, long since retired, was under 8,000 lines and was sophisticated enough to get me some contract work with Blizzard to write machine learning algorithms to hunt for bots in the game world.
- formerly_proven 5y ago
  Couple weeks ago someone posted just this, using an HDMI capture card and a fake USB mouse/keyboard to send inputs back. Got nuked from the 'net pretty quickly, though it made it pretty obvious that with a 20$ HDMI->USB dongle and a microcontroller you can circumvent any anti-cheat, because there is nothing to detect: it's just a PC, with a monitor, and a mouse, and a keyboard.
- MaxikCZ 5y ago
  How does one go about computer vision bot, for WoW for example? I was entertaining the idea for a while. Do you use neural net? How do you train it? How do you solve navigation in 3D world?
  - justinlloyd 5y ago
    Those are some very big questions that cover things such as CNN, body pose estimation, temporal memory, SLAM, VIO and a slew of other techniques to figure out what is going on before being fed back to a very simple behaviour tree.
shmerl 5y ago
Let them work on server side AI for that instead of pushing rootkit spyware on the end user.
robbedpeter 5y ago
Somehow, I think inflicting a rootkit on consumers that don't understand how intrusive it is, especially when a significant number of them are children, is not going to end well. This is malicious and a massive overreach.
- dncornholio 5y ago
  Every Korean game already does this and most people really don't care. For example: League of Legends, Valorant, Black Desert Online, all have very intrusive anti-cheat already and is the norm. You always see huge backlash on the internet, but you never see low player counts.
bob1029 5y ago
The only realistic solution to this problem is to move the audio and video rendering server-side and stream final output to clients from the edge. You have to attack this from an information theory perspective. If the client receives the information in any manner whatsoever, you must assume it is being used in the most adversarial way possible. The AI problem is more complex, but that's more a function of how deep the gameplay is than how good the hacker is. Time constraints make pure machine vision bots subpar for fast-paced games that also have a complex tactical element.
- rumpelstilz18 5y ago
  "The only realistic solution to this problem is to move the audio and video rendering server-side and stream final output to clients from the edge." Too expensive, requires too much crunching power on the server side. Here, CS in your browser: https://play-cs.com/ https://play-cs.com/
- inyorgroove 5y ago
  Sorry to say. There are cheat solutions that can ingest video and emulate keyboard/mouse over usb to pretend to be the user. The kernel driver cheat detection might be able to detect this by only supporting keyboard or mouse device IDs on a whitelist? The cheaters could pretend to be one of those too.
  - t-writescode 5y ago
    There are cheat systems that run on a *different computer*. It is not a battle that can be won.
  - bob1029 5y ago
    We can barely make cars drive themselves with pure vision. I don't think one of these bots is going to make it out of silver league in competitive overwatch. Maybe for a game like counterstrike where it's 100% hitscan you have a stronger argument for machine vision pulling the trigger on an AWP placed on a corner. Complexity and pacing of gameplay is going to eventually have to be one hedge against AI. It's effectively a continuous captcha.
aosaigh 5y ago
To what extent are consoles protected from cheaters? I play COD on PS5 usually with cross play turned off. I feel like I may be a bit imperceptive as I never notice any obvious cheating. To what extent is there cheating on consoles vs PC?
MayeulC 5y ago
I really dislike that, I prefer having an occasional cheater than a kernel mode anti-cheat. Everybody agrees it's a cat-and-mouse game. What's the endgame? Requiring signed peripherals to play? With mouse and keyboard detecting a heartbeat from the player, and gaze tracking? Short of requiring implants with DRM and a proof of identity, I don't think cheating issues can be solved that way. Some suggest streaming is the solution. It doesn't protect against ML-based bots, though restricting client info to the bare minimum is probably a good idea: if latency is good enough to allow streaming video, why not stream player position just in time, to prevent against the wallhacks-class of exploits? ML-powered cheat detection on server side also sounds good, with the usual sanity checks (don't allow large speed, etc). How to distinguish a good player from a cheater? Maybe have them pass a test on a trusted machine at a cyber café or so, and give them a "good player" badge to crank the anti-cheat detection threshold higher for them. There can't be that many good players, and identifying them sounds promising for future tournaments. Maybe a web-of-trust ring would help as well, with players vouching for each other, and staking their accounts too: when someone gets banned 10 years (permanent bans are just not nice), ban those who referred them 3 years, then 6 months, then 2, etc. Also, I've been thinking lately at how this could be handled in open-source games, and if there's a way forward, I think it's that one. At a high-level, game theory kind of approach, I don't think cheating can be prevented in incomplete information games. Two players could collude and exchange information, giving them an edge. This could be made part of gameplay (including vocal chats is probably part of this). Moves can still be checked against a given set of rules retrospectively: use a CRDT-like, directed graph structure to store player actions, check their validity, and when multiple players come in contact with new info, have them exchange that info and cross-validate it. Picture a card game for instance, but it's the same for a FPS. The alternative is complete-information, where there is nothing to hide, and only the legality of a move has to be checked. For reflex-based games, it's hard to evaluate what level of proficiency to expect from a player. For strategy games, likewise (a player could use some AI tools to help them with their next move). In the end, I think we have to go back to what makes playing a game fun. I have fun playing against bots, when they're my level. The only issue is being pitted against bots when I have no chance of winning. In that case, ML-based approaches can work to identify skill levels, and pitch opponents of similar skill against each other. Hopefully aimbots will play against aimbots this way. Also, legalize it, and have people declare what kind of assist they use. Heck, integrate it in the game. There's some people I like playing with, even though they are way less skilled: this could make it better for everyone. It would make games even more accessible to everyone, and make cheat providers redundant.
choeger 5y ago
Wanted to do a couple of rounds in bannerlords with two friends just for fun. One would have bought the game. Then we discovered that we'd need Kernel-Level anti cheat stuff running. Nope the hell out. Vendor lost one sale and two more regular players that day.
donatj 5y ago
Are the cheaters having fun? I don’t understand why it’s so rampant or what they get out of it? It seems like winning without trying would get boring really quickly. As a thought, one could make a game I imagine that actually encourages cheating and have the entire thing be an arms race in cheating tech, that sounds pretty fun .
12ian34 5y ago
I wonder if the scale of cheating in games like CoD Warzone tends to be inflated due to skill-based match-making which would tend to put cheaters (with high kill/death ratios) with content creators (who tend to be good), who go on to complain about it and get millions (/billions?) of views. My anecdata is that I'm a very average player and I haven't noticed any cheaters in lobbies for at least 24 hours of play time which seems at least an order of magnitude longer than the MTBC (mean time between cheaters -_-) for a content creator.
EVa5I7bHFq9mnYK 5y ago
Isn't the arms race against bots doomed to fail ultimatively? With all the advances in AI and visual recognition.
short12 5y ago
What about those who don't do multiplayer and want to cheat. Single player cheating is fun as hell. I miss the days of modifying doom with a hexeditor

179 points by notbaab 5y ago

gigatexal 5y ago

“ When you shut down Call of Duty: Warzone, the driver turns off.” is that really how drivers work?

Arnavion 5y ago
Windows drivers can be loaded and unloaded dynamically, yes. It's also possible that they're using "shut down" semantically and not literally, in that the driver is loaded but inactive while the game isn't running.
- fuj 5y ago
  Isn't this the case for every major OS? I know FreeBSD device drivers can be (un)loaded on-the-fly. Same for MacOS. I assume it's also possible in Linux(?)
  - kaladin-jasnah 5y ago
    It is. I believe you use modprobe -r kernel_module_name to unload a kernel module and modprobe kernel_module_name to load it.
  - Arnavion 5y ago
    Linux lets you disable dynamic modules. OpenBSD removed support for them some years ago.
  - astrange 5y ago
    macOS doesn't let you load kexts anymore since it's less important with drivers moving to userspace.
Sohcahtoa82 5y ago
Yes. Drivers can be loaded and unloaded at will. It's a necessity for USB devices. Heck, these days, even a GPU driver can be hot-swapped.
schmorptron 5y ago
They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.
- novok 5y ago
  What I don't get about this, what prevents your cheats from starting at boot too?
  - schmorptron 5y ago
    I'm not an expert, but from what I've come to understand, anti cheat is for the most part about making it as hard or inconvenient to cheat as possible. You'll never be able to stop it, but putting in hurdles for both the cheat developer and user is key to keeping it limited. The huge problem is that cheaters are very willing to go to extreme lengths of inconvenience or even risk, as in running random cheats as kernel level drivers. So anything that makes the developers have to bypass another hurdle and another component you can patch in your anti cheat "rootkit" gives you a small boost in the cat and mouse game. Your component starting at boot makes it more likely the cheat devs and cheaters will have to do the same and have a more complicated setup.
    - novok 5y ago
      I think making your cheat kernel level is a relatively minor hurdle compared to the lengths that people have been going with ML + hardware based cheats at this point. Maybe we need to stop the kernel anti-cheat just from a pure privacy perspective at this point, or make it an OS service you can implement as a user level module only, much like endpoint management and macOS. I get a feeling there is more to being in the kernel although.

jacquesm 5y ago

Client side security isn't. See also: NFS.

sour-taste 5y ago

I look forward to all the kernel level anti cheat systems interferring with each other and banning players on accident.

novok 5y ago
So far I think there is only about 4 or 5, so they probably all talk to each other to prevent this being an issue.
Teknoman117 5y ago
Look, Halo MCC can't figure out the difference between you quitting and their game crashing.

jpgvm 5y ago

This is an arms race that game developers won't win, it's just whack-a-mole. They should invest instead in server-side models for detecting cheating, then it can't be circumvented and you don't need to bother learning all the different ways they can produce inhuman inputs.

Thaxll 5y ago
"They should invest instead in server-side models for detecting cheating" Which is already the case and can't work for all use cases. how the server knows that you see behind walls exactly? And ML / heuristic stuff is very limited as well. Detecting cheating, client or server side is very complicated and not even close to be a solved problem.
- DizzyDoo 5y ago
  I once had an unusually good match in a popular FPS game, triggered some statistical tripwire, and received an automatic ban for 48 hours. "Just in case". Streamers and pro-players often have their accounts whitelisted from this system, because it would be laughable to happen publicly and show off just how 'security theater' it truly is.
  - KennyBlanken 5y ago
    Streamers and pros use cheats. Google "streamer caught cheating" and there's page after page of news items about people cheating even in tournaments, while streaming. They're "whitelisted" because the game benefits from streamers who look like they're great at the game, and because competition for pro players is actually fairly stiff (in part because there aren't many pro players, because it's so hard to make money at it...but also because being competitive at a game usually means dedicating your training and play time to that game.) Aim fatigue is a problem for pro players and it usually sets in around an hour or two...so when you see a streamer playing really well hour after hour, they're almost certainly employing some level of cheating. It might be really subtle, they might only 'flip it on' when they really have to. But it's there, and at 30-60fps and stream compression it can be really hard to spot even if you're a seasoned player in the game.

benkkey 5y ago

Now they're applying the same solution as what the Riot Games did to Valorant. It's alarming as the anti-cheat has kernel rights. Well, I hope that after they implement the anti-cheat, the hackers will probably decrease and eventually die down.

AlexandrB 5y ago

The only FPS I play is NS2 and cheating seems like less of a problem than what people are describing in these comments. I wonder if it's because you play on community-run dedicated servers and not some opaque matchmaking system. This allows admins to kick cheaters at their discretion. This is the equivalent of forums vs. Facebook. The moderation on well-run forums is better than what Facebook can offer because it's done by real humans.

nazgulsenpai 5y ago

If anyone here played Modern Warfare 2 on PC when it released, you know this is about 13 years late :) While I don't like kernel level anti-cheat, its hard to disagree that its better than nothing and also hard to deny that cheating in competitive realtime multiplayer PC games isn't a huge problem.

Animats 5y ago

Has Microsoft signed off on the kernel driver? Has it passed Static Driver Verifier? Has any third party inspected the driver for security problems? will the vendor contractually commit to the driver not being a backdoor?

snicker7 5y ago

Things like this is why I increasingly game on consoles.

tibbydudeza 5y ago

Brilliant - game devs doing kernel drivers.

Underphil 5y ago
I don't think you realise that many of these companies have large and experienced security engineers and experts who develop these things.
- saagarjha 5y ago
  Sometimes they do, sometimes they give you kernel r/w ¯\_(ツ)_/¯
- tibbydudeza 5y ago
  Yes like the infamous day 1 release patches to get a game working - reputation of game devs and studios are that they slap dash testing/coding to make release dates. Cyberpunk 2077 (cough cough).

mauz 5y ago

Aside: are there any good tutorials that provide an overview on how to write such an anti-cheat?

DizzyDoo 5y ago
No tutorials to link you to, but there's significant overlap between anti-cheat systems and anti-virus/anti-malware systems, which makes sense when you consider their aims. Searching for academic papers about anti-virus approaches to dealing with networking, memory and filesystems will be helpful.
jti107 5y ago
riot had a good white paper on their valorant anticheat and why they designed it to be a kernel level anticheat

dcdc123 5y ago

Huh...that seems a bit excessive.

edave64 5y ago
It's the logical conclusion. The clients machine is inherently untrusted. So how do ensure integrity? Best you can do is try to get to try to get as few layers between you and the machine as possible. It's essentially the same problem as DRM, which generelly can only hope to prevent piracy for a few weeks. The solution of the movie industry there was to add there garbage directly to the hardware.
DizzyDoo 5y ago
If I write a cheat for your game that operates on the kernel level, how would you detect it from the game that runs in user space?
- jstanley 5y ago
  You wouldn't. But it's my computer and it's supposed to serve me, not you.
  - deleted 5y ago
    [deleted]
- bombcar 5y ago
  Next will be cheats that run in hardware themselves ... I wonder if it's possible to flash a video card to force wire framing ...
  - ev1 5y ago
    This is already a thing and somewhat-common, everything from PCIE devices to aimbotters purchasing EV codesigning certs in their own name.
  - sprite 5y ago
    From what I understand there are already cheats that work at the hardware level (read video output, modify mouse input) with all software running on another machine.

judge2020 5y ago

> 3. Protecting Your Privacy. In its initial rollout on Call of Duty: Warzone, the kernel-level driver will only operate when you play on PC. The driver is not always-on. The software turns on when you start Call of Duty: Warzone and shuts down when you close the game. Plus, the kernel-level driver only monitors and reports activity related to Call of Duty. The whole thing is that, if you don't want other kernel drivers touching Windows before yours loads, you have to load yours first (at least, I believe that was a point of contention last time). It'll probably be in the same light as how Riot Vanguard works in that it loads pretty early at boot, but only sends data to the server when you open the game.

q_andrew 5y ago

Not to say this isn't a worrying practice, but it's unfortunately industry standard. Almost every mainstream fps game has intrusive software, to the point where you're expected to be thankful that it's not a rootkit (which is not unheard of).

mgsk 5y ago
Then there's CS:GO, whose developers refuse to use intrusive practices to counter cheating. And the game is ruined by rampant cheating. (Neither for nor against. Just saying.)
- eloisius 5y ago
  It seems like removing incentive beyond trolling is the best solution. Whose spinning up a cluster of bots if you can’t level up and sell digital loot? Market places for digital items has to be the dumbest thing ever in gaming. CS 1.6 was fun and the only thing you could customize was your graffiti spray, and there wasn’t a marketplace for them. You just added an image you liked.
- tpxl 5y ago
  Then there's PUBG (BattlEye) ruined by rampant cheating. Then there's EFT (BattlEye) ruined by rampant cheating. Then there's (was?) Combat Arms (multiple anti cheats over the years) ruined in-part by rampant cheating. I wouldn't mind _that_ much if anti-cheats actually helped, but they don't.
  - remarkEon 5y ago
    EFT getting ruined by cheating is such a tragedy, too. Most immersive and, well, interesting and unique FPS out there (imo). I still play it though, and only encounter cheaters on certain high loot maps at this point (Reserve and Labs).
  - DizzyDoo 5y ago
    I'm still playing PUBG, though just FPP, and rarely run into what is obviously a cheater - maybe once every two months? But while things have got better, you're right, when things were really, really bad it hurt the game's community terribly. I do think that anti-cheat helps, if the developers are mostly engaged with it, but it's a long fight over a long time. Most of the strategies to do with 'ban waves' - ie, not banning cheaters immediately - are pragmatic concessions to that reality.

brink 5y ago

Probably going to make it proton-incompatible, I'm guessing.

bitwize 5y ago
There'll be patches to enable this for Linux soon enough.
- Thaxll 5y ago
  There is 0 chance of this happening. Anything in kernel won't be working at all, and I'm 100% sure that Activision won't make any effort to make it work on Linux. None of the Kernel anti cheat work without being compatible with Linux which currently none of them are. EAC is supposed to be in the future but I doubt it will work.
  - MrKiwi 5y ago
    EAC already supports Proton, albeit recently, [1] and BattlEye supports Linux and macOS natively already with Proton support in the pipeline [2]. It's not impossible, it's just up to Activision. [1] https://dev.epicgames.com/en-US/news/epic-online-services-launches-anti-cheat-support-for-linux-mac-and-steam-deck https://dev.epicgames.com/en-US/news/epic-online-services-la... [2] https://twitter.com/thebattleye/status/1441477816311291906 https://twitter.com/thebattleye/status/1441477816311291906
    - Thaxll 5y ago
      Except that dev has to opt-in which I'm pretty sure none of the major studios will do, supporting another platform for a very vocal population with a few users.
      - benbristow 5y ago
        Activision make a killing from selling DLC & Season Passes from their games like Call of Duty. Not sure why they'd give up free money from a single toggle switch with no extra work. Unless out of spite, like when Snapchat banned third-party clients for Windows Phone (like 6snap) and accounts using it (I'm still raging that my 'benbristow' username got banned and now I'm using 'benbristow1' because of that). Fun fact: The guy that made 6snap (and other 6 prefixed apps like 6tin (Tinder)) (Rudy Huyn) was hired by Microsoft and is now one of the leads behind the updated Windows 11 Store app

rafale 5y ago

Microsoft should implement an Xbox mode for Windows that has these protection features for all games. It will probably require some virtualization and performance degradation but it's better than each game rolling out their own half assed drivers.

908B64B197 5y ago
Ironically, in XBox OS I'm pretty sure there's not a big distinction between usermode and kernel mode.
- zeusk 5y ago
  There is, it's windows with a different shell since 2013
- Arainach 5y ago
  Everything is very much separated. It's actually a series of OSes running in a hypervisor. http://meseec.ce.rit.edu/551-projects/fall2016/3-4.pdf http://meseec.ce.rit.edu/551-projects/fall2016/3-4.pdf https://www.youtube.com/watch?v=quLa6kzzra0 https://www.youtube.com/watch?v=quLa6kzzra0 (for software discussion check around the 19:00 mark but the whole talk is incredible)
VortexDream 5y ago
How about no? This will just lead these companies to implement anti-cheat to protect the "integrity" of their single player games (and their MTX) as well. Say goodbye to mods and other forms of benign game hacking (particularly hacks that fix games like Dark Souls).
- divbzero 5y ago
  Would it be in a game company’s interest to implement anti-cheat for single player games? Mods and other forms of benign game hacking increase the popularity and longevity of games which presumably benefit profitability.

VWWHFSfQ 5y ago

It's cheating really that big of a deal? How do they try to stop it now? Do they really need a kernel driver?

rasz 5y ago
They need kernel driver because running garbage code on user computers is cheaper than deploying server side user input validation.
ProAm 5y ago
It's been really bad in CoD, this has been requested for a while.
cstrahan 5y ago
Yeah, it's pretty bad. > How do they try to stop it now? Generally, they don't. They have an in game reporting function, but it doesn't seem to do much good. Many cheaters live stream their exploits, seeing people through walls, getting 100%-accuracy-all-head-shots, etc. The net code that's responsible for reporting where you are aiming is separate from the data/code that reports where your bullets are sent, so some cheaters show off by shoot directly at the ground below their feet while magically killing people several hundred feet up above in a helicopter. The experience is often pretty bad, and yet people still play the game...
vkou 5y ago
> It's cheating really that big of a deal? Yes, it makes competitive/casual play crap. In CoD in particular, it is out of control. > How do they try to stop it now? A variety of ways, ranging from server-side analytics, player-driven report systems, manual review, the game inspecting its own state, processes that spy on your computer, and rootkits. Each and every one of these has different advantages and drawbacks. > Do they really need a kernel driver? Given how ineffective anti-cheat efforts in CoD have been, it's possible that they need a kernel driver to bring it under control. It's possible that a more talented team would not.
DizzyDoo 5y ago
It's not just a big deal, it's a massive market. There are many people who will pay an enormous amount of money for custom written cheats, there are whole SAAS-style subscription services for different game hacks, it's... all a bit silly. It's when there's a whole cottage industry around this that you know things are out of hand.

Santosh83 5y ago

So the endgame would be a type-1 anti-cheat hypervisor I guess?

donkarma 5y ago
nah, you'd just get nested virtualisation cheating hypervisors
- technick 5y ago
  mind blown
- temporarrry0923 5y ago
  Yeah I actually almost worked with a ESEA cheat provider that did exactly this. It was a hypervisor that ran the kernel-AC within it. It really subverted my expectations, if you will ;)

MR4D 5y ago

Can anyone tell me why Fortnite doesn't seem to have as bad of a problem as CoD? My son plays both, but CoD really sucks. It is so obvious when someone is cheating.

justwalt 5y ago
I think Fortnite uses a projectile bullet model while Call of Duty is all hitscan, but I could be mistaken. It’s been years since I played a CoD game.
- vesrah 5y ago
  There were bots for Quake 3 Arena that accounted for projectile speed and enemy player movement. I believe Fortnite uses some kind of bloom in accuracy though.
- echlebek 5y ago
  Call of Duty uses projectile bullet models.
NtGuy25 5y ago
Fortnite has a decent anticheat, which also runs in Kernel. The skills to evade a solely usermode monitor isn't that hard, since you can literally just watch api calls and defend against some memory forensics. This is made harder for the cheat dev due to things like Discord running dynamic code, which looks EXACTLY like shellcode/cheat payload. Especially in a world with limited customer support, and even more limited on anyone who can help, false bans are a big concern. DKOM(reading/modifying kernel structures directly) is alot harder to detect, and also alot more undocumented. To the point it takes someone in the field to make a cheat and bypass, vs someone with a decent level of application dev experience. And there's not many Kernel developers, and there's also such a limited amount of forensic/malware analysts that can code anything beyond powershell.
EastOfTruth 5y ago
> It is so obvious when someone is cheating. It is not always very obvious, at least on CSGO... there are some experienced/smart cheaters.

jccalhoun 5y ago

Cheaters are going to figure out a way to cheat. Even if it means some kind of TASBot device to physically press the buttons on a controller there will always be a way for someone to cheat.

mdoms 5y ago
If we imagine we're in a world where all cheaters are forced to use a physical device to cheat - that's a big win. Sure some people will still cheat but the number of players who would go this far and spend this much to do so would be vanishingly smaller than those who can download some sketchy .exe in an afternoon.
temporarrry0923 5y ago
It's not about stopping cheating, it's about stopping the bleeding. Some games have a horrendous cheating problem
darkcha0s 5y ago
But you've in a way just defended the move itself. Lots of people will spend 10$ on a .exe which makes them better, less will spend the time and effort to set up a TASBot device.

mdoms 5y ago

Good. It's a never ending arms race but the more developers are doing to make cheating hard the better. Nothing can destroy an online FPS as thoroughly as rampant cheating.

everdrive 5y ago

If this happens enough, then a Windows gaming PC becomes a very expensive console. If all I do on my PC is game, then it doesn't really matter if it's got a rootkit (or kernel-level anti-cheat driver) or not. But, that's an expensive console. $600 - $2,000, depending on how nicely you want to game. A lot of the big popular online game culture really isn't fun anyway, so I'm not sure it's much of a loss.

npteljes 5y ago
I already use my Windows system like this. Between the anti-cheats and Microsoft's push for telemetry in Windows, I just don't feel comfortable using my Windows as my own private system. So I don't.
leshow 5y ago
2k will barely get a decent video card these days, cards aren't selling at MSRP
- everdrive 5y ago
  I just got a pretty good low end pre-built PC for ~$600: Nvidia GTX 1650s Ryzen 5 3rd Gen Not amazing by any stretch, but definitely good enough to play most games.
int_19h 5y ago
Online gaming doesn't necessarily mean competitive PvP. Co-op tends to be a lot less toxic.
- everdrive 5y ago
  Indeed, but then there is less need for anti-cheat in co-op.
  - int_19h 5y ago
    That's very true, but once an anti-cheat solution is deployed, it tends to be deployed universally for online gaming. So those who mostly or exclusively play co-op still have to deal with intrusive anti-cheat systems, for no tangible benefit to them.

bee_rider 5y ago

These sorts of things always get circumvented, but I wish the CoD players fun during the 1-2 week gap where the cheaters are still figuring it out. I've actually figured out the permanent solution to cheaters. Oddly enough, I worked it out in Pokemon Unite, which doesn't have a cheating problem as far as I know, but does have items that you can buy to boost your character stats. The solution is easy: play a game with a good ranking system, and don't get too sweaty about the whole thing. People who use non-skill based tools like cheating or paid boosts will shoot right up the rankings and leave you behind to play in peace. If somebody has a cheating tool that is so subtle that they play all the way down at my level, it is arguably not a real help anyway.

IanSanders 5y ago
I have a different solution. Shadowban. Let them play against each other and bots. Decrease network performance. In rng based situations, roll low most of the time.
InitialLastName 5y ago
Having cheaters go up the rankings will invalidate peoples' internet points though. If developers undermine the perceived value of the Skinner Box rewards, players might disconnect the vacuum hose from their wallets.
dTal 5y ago
I agree that going to extraordinary lengths to prevent software augmentation of gameplay is attacking the wrong thing. What does it matter, if people are still having fun? But software augmentation doesn't just improve apparent skill, it can also distort gameplay. What if you're really skilled and you get matched with what amounts to a bot? Even if you're good enough to overcome the bot and win the game, it won't be the game you signed up to play. The real problem here is "annoying play styles", something that humans are capable of indulging in without any software help. This is usually policed - ineffectively - by social pressure ("no camping!"). The real solution is an extension of the ranking system - a reputation system, which tracks sportsmanship. All of these problems ultimately stem from the practice of connecting vast numbers of anonymous strangers with each other - cheatbots simply aren't an issue when you play with your friends. This is a social problem.

RattleyCooper 5y ago

> In its initial rollout on Call of Duty: Warzone, the kernel-level driver will only operate when you play on PC. The driver is not always-on. The software turns on when you start Call of Duty: Warzone and shuts down when you close the game. Oh that's good. > Plus, the kernel-level driver only monitors and reports activity related to Call of Duty. Oh, so in other words it reports everything since any software that might be used to cheat at call of duty is technically related to call of duty... Whenever I see this kind of vague verbiage it's never a surprise when it turns out the people who wrote it chose their words very carefully, to purposefully mislead people. Edit: Oh, and they definitely say they monitor other software "that interacts with call of duty" later in the article.

Arnavion 5y ago
You don't really have to put so much effort into dissecting their verbiage. It's guaranteed that any kernel anti-cheat is going to be invasive and inspect everything on the system while looking for cheats.
- KennyBlanken 5y ago
  No, it's absolutely not guaranteed. Especially in competitive shooters, performance is paramount. They have a strong motivation to only look where they need to. And anti-cheat isn't a money-maker, so they're not going to be spending lots of money storing user data they don't have to. Cheat software has to do things like nose around in the game's memory space that no legitimate program is going to do. It also contains in its memory space keywords common to cheat programs. That sort of search isn't really invasive because generally anti-cheat software when it triggers takes an screenshot, and if you're playing the game, there's nothing personal on the screen. Maybe a process is fingerprinted as a known cheat package. Say your kill to death ratio or hit/miss is unusually good. Or you get reported by a higher than normal number of people. Or a human moderator pushes a request, for whatever reason. Or they get a hit on the 'greps' I mentioned, etc. The goal is to see if you've got a screen overlay that betrays wallhacking (ie "glasswalling") or a cheat system's UI. That's all they care about.

foresto 5y ago

John McDonald did a talk at GDC 2018 about how Valve was starting to integrate deep learning into their server-side cheat detection. IIRC, some of the process was automated, some was player-reported, and some was done through human review. As a gamer averse to both cheating and spyware, I found this very appealing. I wonder how their systems have evolved since then. The original youtube clip (v=ObhK8lUfIlc) has been made private, but I think this is a copy of the same video: https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc

temporarrry0923 5y ago
VACnet catches the spinbotters and aimbotters! Actually really good at it too; everyone who did that now just cheats less hard. The biggest problem was: It didn't auto ban, just sent to overwatch (players watch a past game and vote for cheater or not, fully anonymized). This resulted in a massive clog when some guys I knew generated around 10k free steam accounts (with $3.5 of proxies), began queueing a few dozen at a time, rage cheating. A hell of a lot of games can be botted with free accounts and a beefy (server IIRC) rig; I think he told me he had about 100 accounts running normally in 10 separate Competitive games all against his own bots(rendering at 2x2 resolution so it ran okay, with cheats injected). They all got sent to overwatch but because so many games were being put through overwatch, the queue got overloaded. This is called Vertigo boosting, because the bots all queued for Vertigo, an unpopular map, to increase odds that only their own bots would be in the game (and, coincidentally, minimize collateral damage to legitimate players). (though it's normally to rank up accounts, not to spam ow queue) Hi eso :p
- nwiswell 5y ago
  This is how we end up with kernel level drivers rather than more measured approaches.
  - temporarrry0923 5y ago
    For sure in other games, yeah. Newell is opposed to kernel anti cheats, though, so probably not in CSGO. But other games now look at CSGO and make kernel AC's a selling point (literally Valorant's selling point), so yeah.

remarkEon 5y ago

I'm a little out of my depth on this particular topic. Is it possible to stop this[1] kind of cheat without some kind of hardware verification? [1]https://www.youtube.com/watch?v=revk5r5vqxA https://www.youtube.com/watch?v=revk5r5vqxA

Kuinox 5y ago
No, but TPM would allow unavoidable hardware ban. So when someone is caught, with manual review for example, they won't be able to play again on the same hardware.
- Teknoman117 5y ago
  That, or hackers would just use a TPM compatible device you can reassign the keys on. Not necessarily useful from a security point of view, but would get you around bans by hardware id.
  - no_time 5y ago
    Does not work like that. The keys are signed by the vendor of the hardware. You are essentially paying for the hardware AND the signed keys within it. The server can choose to only trust vendor signed keys.
    - Teknoman117 5y ago
      And how long until one of those vendor keys is compromised? Can't exactly revoke the signed key for everyone's hardware. All it takes is a single malicious actor or nasty breach at one of the issuing companies and it's all over. It doesn't appear to have been a big target thus far, but if we get to the point where companies are perma-banning devices, It's not hard to imagine those becoming target #1 for various blackhat groups.
      - no_time 5y ago
        It's probably a similar infra to root CAs that sign TLS keys. I don't recall a root CA compromise in recent memory.

Teknoman117 5y ago

The most annoying one to me is that a bunch of these kernel mode anti-cheat systems also go after the VFIO gamers who don't want to run Windows on bare metal. They consider running Windows in a VM "cheating".

CodeArtisan 5y ago
These anti cheats have no other choice than become more and more restrictive to the user. Cloud gaming for everyone coupled to a game controller relying on a secure cryptoprocessor may put a end to cheating in the large.
- shadilay 5y ago
  It won't. There are already people using AI image recognition running on a separate PC to aimbot.
- no_time 5y ago
  What's the point of a "secure cryptoprocessor" in a controller when you can de-solder the buttons and trigger them via another MCU? Do you make them like POS terminals that self destruct when they are opened? I can just use a servo to press the buttons. With the release of YOLOv5, the rat race for cheater free games just got even more one sided.
cotton-cho 5y ago
You can try this out https://superuser.com/a/1389159 https://superuser.com/a/1389159 I have a similar configuration on my Single GPU passthrough and I am able to play games like Fall Guys that have anti-cheat engine. I also tried some other games and have no issues so far. Lmk if you need more help with setting everything up.
sapphyrus 5y ago
The problem is that running Windows in a VM is an easy way of getting around current Anti-Cheat software. You can write a cheat that runs on the host OS and reads/writes game memory by directly accessing the guest memory. Even worse, the guest OS has no real way of detecting if you're doing anything malicious so it kind of just has to assume that you're trying to cheat if you're running a VM.

userbinator 5y ago

It's a cat-and-mouse game, where the mice basically have infinite time to spend on anti-anti-cheat... and dare I say it, countless young people probably got their head start in learning about computers, programming, reverse-engineering, etc. by playing this "meta-game". I know some people who were otherwise completely uninterested in the typical STEM courses at school, but highly skilled at the sort of low-level knowledge required to defeat anti-cheat systems, and thus started their career in software development.

aejnsn 5y ago
Hi. Have we met or something?
22c 5y ago
I don't doubt any of that but what I don't understand is where these guys are getting all their accounts from. I feel as though if I were making a hack for a game, I'd get numerous accounts banned in the process (which means needing to buy more and more copies of the game). A youngster getting into reverse engineering surely does not have deep enough pockets to spend several hundreds of dollars on buying the game over and over.
- lotophage 5y ago
  CoD warzone is free to play. The paid accounts I always assumed were either hacked or bought with stolen credit card numbers.
- gjs278 5y ago
  CS:GO is free
- darkwizard42 5y ago
  COD Warzone and a few others in the free to play category are just that... free to play and quite easy to create new accounts for
difu_disciple 5y ago
Self-taught but that's how I got started early on https://github.com/cheat-engine/cheat-engine https://github.com/cheat-engine/cheat-engine

lemoncookiechip 5y ago

And it does absolutely nothing to prevent actual cheating (look at Valorant and other games with similar anti-cheat) and adds more fuel to the fire that is privacy concerns.

arbirk 5y ago

On windows kernel level drivers are a small step up from the access games already have. If it makes it easier to detect cheats then I'm all for it. It seems like EAC is going to be the standard for cross game HWID ban list. Again I'm all for it.

pronlover723 5y ago

I just bought Back4Blood ... and then got a refund when I realized it required admin to install kernel level services for DRM. So disappointed as L4D and L4D2 are some of my favorite games ever.

lemoncookiechip 5y ago

While I don't particularly like this sort of anti-cheat, I think we should all be more worried about cloud gaming than anything else. It's been obvious for a while that the big gaming companies have it in mind, and the only reason it isn't as big as it could be, is due to tech limitations FOR NOW. When (not if) cloud gaming truly takes off, and it will, we'll lose any and all control over our games. So long to modding, so long to messing with .ini files to get settings right, no decompiling games, no games preservation... The Netflix model approach, where we don't own anything, we're 100% reliant on them to provide us with the service, where servers can (and do) get shutdown at any moment after X amount of years of support. A world where we don't own the games, just subscription services with extra fees for XP boosters. The ultimate live service game that so many of the big companies love. PS: Also means no more cheating by the standard methods.

veb 5y ago
This is kind of already happening with the Xbox Game Pass Ultimate. So you get hundreds of games to play, but you actually don't own any of them. I understand you meant it in a different light but I thought I'd give it a mention.
xarball 5y ago
I agree that your point on cloud gaming is probably valid for companies trying to maintain a rigid grip over software piracy when the companies still build things that can be stolen -- But I don't think it's strictly necessary for the development of anti-cheat systems. In the next version of Windows, we're seeing a rapid acceleration in the amount of hardware/software fingerprinting and secure storage going on in home computing, with the introduction of the TPM 2.0 and UEFI requirements. I am almost certain that Microsoft is progressing to be able to sell a completely hardware-protected memory address space to game developers, so that they no longer HAVE to worry about cheating. Because if everything from boot onwards is both signed and supports DRM, it's the perfect place to authenticate everything that happens afterwards. This is interesting in that it will almost certainly lead to an explosion of DRM, DLC, and software sold via subscription models. And while this kind of thing will probably be initially well received by players hoping for decent anti-cheats, it will almost certainly lead to users forfeiting even more control to corporations over the final direction of the software programming. (This kind of control may eat itself alive given enough time; we'll really only know after humanity has already gone that far!)

yjftsjthsd-h 5y ago

Okay, so the policy questions are interesting, but I have a technical question: How are they handling kernel compatibility? Even with DKMS API breakage could be brutal, and Valve supports Arch as a first class target so they can't just stick to a stable/old version (it'd be easy with RHEL and doable with Ubuntu, but Arch?).

dbaggerman 5y ago
I was a little confused about this as well - until I realised they don't actually specify that this is the Linux kernel. I suspect what they're talking about here is the Windows kernel.
- yjftsjthsd-h 5y ago
  Oh. Thanks, I just... I'd heard about folks working on anticheat for Linux, so I just assumed... You're right, though.
jamesfinlayson 5y ago
I've heard that Valve's VAC only runs on Windows so maybe they're doing the same thing.

xerxes901 5y ago

The whole "super intrusive anti-cheat" thing is really annoying to me as a non-competitive player, who just plays games like CoD, CS, etc occasionally with friends. And not just academically annoying, but practically too. I used to run Windows virtualised under Linux with a PCIe passthrough GPU. I remember having to re-install windows directly on my machine at a LAN party once because CS:GO couldn't be run in a VM anymore :( I think there's a solution that would let wood-tier players like myself avoid this kind of intrusive software, whilst keeping higher-level play clean though. - Implement server-side anticheat detection, that will ban things that look like bots. As other commenters have noted, bots are indistinguishable from good humans from the outside. So, the server-side detection would ban both bots and good humans - Have _opt-in_ client side anticheat detection. If you have this enabled, then you're exempted from the server-side detection. So, you enable this if you're actually good. Could even make this part of the ranking mechanics. Maybe you _can't_ enable the client-side anticheat until the server-side one thinks you're sus. Then you get prompted to turn on the client-side support and get a cool badge or something.

simooooo 5y ago
Why am I not surprised the top comment is complaining that GPU pass through to a VM isn’t supported
cletus 5y ago
This isn't a high-level gameplay problem. I'm not sure what you play but in (CoD) Warzone, for example, just based on Twitch streams at least, almost every lobby has one or more cheaters/hackers in it now. This is a bad enough problem that it actually threatens the integrity of the game and the continued support from more casual gamers such as yourself. As for your particular case (running a Windows VM with PCI-e GPU passthrough), that's... such a niche corner case that you're you just don't factor in. We can agree that cheating will never be truly eliminated. It's a question of degree and it requires a multi-level solution ie both client-side and server-side.. The server-side detection has to allow for checking by a human with all that entails. It sounds like this is what they're rolling out with CoD Vanguard (Ricochet). It'll be interesting to see how effective this is. Probably the biggest problem for the likes of Warzone and Fortnite is that the game is free. It means getting banned and having to create a new account is essentially zero cost. What about paid-for and earned cosmetics I hear you ask. Well, those are hacked too so it doesn't really matter.

CivBase 5y ago

I understand the desire for powerful anti-cheat, but this is such an intrusive way go go about it. And it's increasingly pointless since you can't detect cheats which are running on a second PC [0]. Instead, this sounds like a great application for machine learning. Train an algorithm to identify a wide suite of cheats using data passed to the server. It wouldn't work for P2P, but if your competitive matchmaking uses P2P then you have bigger problems. [0] https://www.tomshardware.com/news/impossible-to-detect-cheating-tool https://www.tomshardware.com/news/impossible-to-detect-cheat...

milomilo86 5y ago

Good! I’m tired of getting my ass kicked in COD

lvs 5y ago

Aren't the widely deployed Easy Anti-Cheat and Battleye also using creepy kernel modules?

Flow 5y ago

Client-side anti-cheat is a futile endeavor these days and besides being ineffective probably is user-hostile too. Server-side machine learning is the way to go. Also the server should not send info a legitimate client have no use of.

tester34 5y ago
>Server-side machine learning is the way to go. If it has 99% accuracy, then you're banning thousands of players have fun dealing with tickets for them & review process >Also the server should not send info a legitimate client have no use of. do not games send "too much" in order to play around networking constrains?
- Flow 5y ago
  > If it has 99% accuracy, then you're banning thousands of players Obviously you can't just automatically permaban people if the system is not based on a technical inspection of the player's system. Instead you have to bar them from playing for a few days or so. Even VAC reverses bans sometimes. If you are looking for a perfect solution there will never be one. > do not games send "too much" in order to play around networking constrains? Maybe the newest games does that. CSGO and other popular games send complete positions and what-not to every player.

weq 5y ago

I work in Ed-tech and this conversation is intersting to me because we build anti-cheating into our online assessment platforms.

justinlloyd 5y ago

Client-side anti-cheat is pointless, it just captures the low hanging fruit. Kernel level drivers are also kind of useless, easy to circumvent, easy to reverse engineer. Building a capable computer vision bot that can play World of Warcraft, Diablo and CS:GO is trivially easy to do these days. We're talking a few hundred lines of Python to build a working prototype that will track and kill and take objectives. I have a computer vision Diablo 3 bot of less than 2,000 lines of Python that can run Rifts and and grind high level Grifts with complete success, including boss encounters and adds. My World of Warcraft computer vision bot, long since retired, was under 8,000 lines and was sophisticated enough to get me some contract work with Blizzard to write machine learning algorithms to hunt for bots in the game world.

formerly_proven 5y ago
Couple weeks ago someone posted just this, using an HDMI capture card and a fake USB mouse/keyboard to send inputs back. Got nuked from the 'net pretty quickly, though it made it pretty obvious that with a 20$ HDMI->USB dongle and a microcontroller you can circumvent any anti-cheat, because there is nothing to detect: it's just a PC, with a monitor, and a mouse, and a keyboard.
MaxikCZ 5y ago
How does one go about computer vision bot, for WoW for example? I was entertaining the idea for a while. Do you use neural net? How do you train it? How do you solve navigation in 3D world?
- justinlloyd 5y ago
  Those are some very big questions that cover things such as CNN, body pose estimation, temporal memory, SLAM, VIO and a slew of other techniques to figure out what is going on before being fed back to a very simple behaviour tree.

shmerl 5y ago

Let them work on server side AI for that instead of pushing rootkit spyware on the end user.

robbedpeter 5y ago

Somehow, I think inflicting a rootkit on consumers that don't understand how intrusive it is, especially when a significant number of them are children, is not going to end well. This is malicious and a massive overreach.

dncornholio 5y ago
Every Korean game already does this and most people really don't care. For example: League of Legends, Valorant, Black Desert Online, all have very intrusive anti-cheat already and is the norm. You always see huge backlash on the internet, but you never see low player counts.

bob1029 5y ago

The only realistic solution to this problem is to move the audio and video rendering server-side and stream final output to clients from the edge. You have to attack this from an information theory perspective. If the client receives the information in any manner whatsoever, you must assume it is being used in the most adversarial way possible. The AI problem is more complex, but that's more a function of how deep the gameplay is than how good the hacker is. Time constraints make pure machine vision bots subpar for fast-paced games that also have a complex tactical element.

rumpelstilz18 5y ago
"The only realistic solution to this problem is to move the audio and video rendering server-side and stream final output to clients from the edge." Too expensive, requires too much crunching power on the server side. Here, CS in your browser: https://play-cs.com/ https://play-cs.com/
inyorgroove 5y ago
Sorry to say. There are cheat solutions that can ingest video and emulate keyboard/mouse over usb to pretend to be the user. The kernel driver cheat detection might be able to detect this by only supporting keyboard or mouse device IDs on a whitelist? The cheaters could pretend to be one of those too.
- t-writescode 5y ago
  There are cheat systems that run on a *different computer*. It is not a battle that can be won.
- bob1029 5y ago
  We can barely make cars drive themselves with pure vision. I don't think one of these bots is going to make it out of silver league in competitive overwatch. Maybe for a game like counterstrike where it's 100% hitscan you have a stronger argument for machine vision pulling the trigger on an AWP placed on a corner. Complexity and pacing of gameplay is going to eventually have to be one hedge against AI. It's effectively a continuous captcha.

aosaigh 5y ago

To what extent are consoles protected from cheaters? I play COD on PS5 usually with cross play turned off. I feel like I may be a bit imperceptive as I never notice any obvious cheating. To what extent is there cheating on consoles vs PC?

MayeulC 5y ago

I really dislike that, I prefer having an occasional cheater than a kernel mode anti-cheat. Everybody agrees it's a cat-and-mouse game. What's the endgame? Requiring signed peripherals to play? With mouse and keyboard detecting a heartbeat from the player, and gaze tracking? Short of requiring implants with DRM and a proof of identity, I don't think cheating issues can be solved that way. Some suggest streaming is the solution. It doesn't protect against ML-based bots, though restricting client info to the bare minimum is probably a good idea: if latency is good enough to allow streaming video, why not stream player position just in time, to prevent against the wallhacks-class of exploits? ML-powered cheat detection on server side also sounds good, with the usual sanity checks (don't allow large speed, etc). How to distinguish a good player from a cheater? Maybe have them pass a test on a trusted machine at a cyber café or so, and give them a "good player" badge to crank the anti-cheat detection threshold higher for them. There can't be that many good players, and identifying them sounds promising for future tournaments. Maybe a web-of-trust ring would help as well, with players vouching for each other, and staking their accounts too: when someone gets banned 10 years (permanent bans are just not nice), ban those who referred them 3 years, then 6 months, then 2, etc. Also, I've been thinking lately at how this could be handled in open-source games, and if there's a way forward, I think it's that one. At a high-level, game theory kind of approach, I don't think cheating can be prevented in incomplete information games. Two players could collude and exchange information, giving them an edge. This could be made part of gameplay (including vocal chats is probably part of this). Moves can still be checked against a given set of rules retrospectively: use a CRDT-like, directed graph structure to store player actions, check their validity, and when multiple players come in contact with new info, have them exchange that info and cross-validate it. Picture a card game for instance, but it's the same for a FPS. The alternative is complete-information, where there is nothing to hide, and only the legality of a move has to be checked. For reflex-based games, it's hard to evaluate what level of proficiency to expect from a player. For strategy games, likewise (a player could use some AI tools to help them with their next move). In the end, I think we have to go back to what makes playing a game fun. I have fun playing against bots, when they're my level. The only issue is being pitted against bots when I have no chance of winning. In that case, ML-based approaches can work to identify skill levels, and pitch opponents of similar skill against each other. Hopefully aimbots will play against aimbots this way. Also, legalize it, and have people declare what kind of assist they use. Heck, integrate it in the game. There's some people I like playing with, even though they are way less skilled: this could make it better for everyone. It would make games even more accessible to everyone, and make cheat providers redundant.

choeger 5y ago

Wanted to do a couple of rounds in bannerlords with two friends just for fun. One would have bought the game. Then we discovered that we'd need Kernel-Level anti cheat stuff running. Nope the hell out. Vendor lost one sale and two more regular players that day.

donatj 5y ago

Are the cheaters having fun? I don’t understand why it’s so rampant or what they get out of it? It seems like winning without trying would get boring really quickly. As a thought, one could make a game I imagine that actually encourages cheating and have the entire thing be an arms race in cheating tech, that sounds pretty fun .

12ian34 5y ago

I wonder if the scale of cheating in games like CoD Warzone tends to be inflated due to skill-based match-making which would tend to put cheaters (with high kill/death ratios) with content creators (who tend to be good), who go on to complain about it and get millions (/billions?) of views. My anecdata is that I'm a very average player and I haven't noticed any cheaters in lobbies for at least 24 hours of play time which seems at least an order of magnitude longer than the MTBC (mean time between cheaters -_-) for a content creator.

EVa5I7bHFq9mnYK 5y ago

Isn't the arms race against bots doomed to fail ultimatively? With all the advances in AI and visual recognition.

short12 5y ago

What about those who don't do multiplayer and want to cheat. Single player cheating is fun as hell. I miss the days of modifying doom with a hexeditor