6 ms·

If that's what is needed to fight against cheating, then it will only escalate. The bottom line then is don't do anything else with your gaming machine: no work

If that's what is needed to fight against cheating, then it will only escalate. The bottom line then is don't do anything else with your gaming machine: no work related stuff, no banking, no email, no social networking, no personal data or any access to the home NAS, no projects, nothing but games. Connect it to a low latency firewalled network plug on the router that would let it see only the outside and that's it. Use then a lower power machine for everything else, and treat the gaming machine as already compromised out of the box.

Arcsech 5y ago
The shortcut to implementing this technique is buy a gaming console. Gaming companies seem very committed to their desire to root your box, so might as well just get one pre-rooted and use it for nothing else.
- DangitBobby 5y ago
  Games on PC are very cheap, though. I spend less for more games now than when I used consoles growing up.
  - kbenson 5y ago
    There's lots of cheap indie games and game pass services on the consoles too, from what I understand. I'm not sure games on PC are much cheaper. Do you have examples of what you're talking about? Are big titles like $10 more on consoles for licensing fees or something?
    - stnikolauswagne 5y ago
      I think there are three arguments to be made for PC being overall cheaper 1) XBox Gamepass offers a huge library of often new games for a cheap rate. That service is also available on Xbox consoles but those are much less popular than their competition. 2) Epic Games offers a bunch of games for free to entice people into switching over from steam, not sure about the current situation though. 3) Steam often offers very deep discounts on games and due to the relative ease you can buy keys from resellers you can get games for super cheap. As an annectode I was able to get my girlfriend 250€ worth of expansions for sims for less than 40€, discounts this deep are hard to get on console.
  - fomine3 5y ago
    Current gaming console itself is crazy cheap compared to gaming PC.
    - DangitBobby 5y ago
      Not at all. With sites like isthereanydeal.com and random and seasonal sales, I very rarely pay more than $25 for a game. My typical price for a game is $10 and one that I can play with all my friends inline would run about $15.
      - fomine3 5y ago
        Price for game is different story.
        DangitBobby 5y ago
        I thought you said "console gaming" but you said "gaming console." Whoops.
      - Arcsech 5y ago
        Grandparent wasn't talking about the games, they were talking about the systems. If you can find one, a PS5 or XSX cost about $500. You can't buy very much gaming computer for $500.
nathanvanfleet 5y ago
Uh okay
NtGuy25 5y ago
It's not. Binary protection is easy and you won't be able to stop high level attackers. It's similar to the EDR field where it's monitoring heuristics and trying to correlate those to attacks. And it's also similar in that normally it functions off of a whitelist, but they get a bit more coverage since they only care about a singular program which they control. Companies get most of it from either filter drivers or ETW. Which effectively give a callback and notification for every handle or handle operation (So Networking, File, Registry, InterProcess, etc...). The good way to do this is ETW which gives you events and doesn't allow changing of these events, unlike a filter driver that can modify these requests. And this stops 99 % of people. ETW even runs in usermode as opposed to a driver. They also do malware techniques such as loading shellcode over the wire so it's difficult to audit the actual malicious stuff they're doing. There's zero reason for them to need anything like what Riot does with Vanguard and it's a joke that consumers allow this. It's them trying to jump to the top of the stack and abuse Kernel. But they're engineers are to stupid to realize this opens up complexity in the architecture and makes it easier to break and bypass.
kbenson 5y ago
They already have locked down special purpose gaming machines. They're called gaming consoles. Really, if keyboards and mice were more accepted components of those that developers always accounted for, I would just buy a console for gaming (except all my old games, but really, that wouldn't be hard to handle on a console either). It's already a little concerning to me that I play games on my main PC for the same reasons you most likely are worried about it. As it is, I try to keep it to things on Steam and the occasional old dosbox game from GOG, so at least I don't have to be hyper aware of all the different individual launcher capabilities.
zeta0134 5y ago
This is precisely why I own several game consoles. If I really want to play a game from known shady publishers (Ubisoft especially), it goes on the PS4 which has nothing on it that I actually care about. Go ahead, mess with Sony's OS, I don't care. But that nonsense does not touch my workstation.
andrepd 5y ago
You can always stop playing LoL :)
- StreamBright 5y ago
  Many of us did. :)
forrestthewoods 5y ago
How much random open source code do you compile and execute? How many programs do you run? At the end of the day it’s about trust. If you don’t trust Riot to run lol.exe then you definitely shouldn’t run their service! But if you trust Riot enough to run lol.exe it can do anything to your computer. The difference between lol.exe running in the foreground and something else running in the background is negligible from a security standpoint.
- Crespyl 5y ago
  Foreground or background I can agree with, but there's definitely a different level of trust involved if Riot wants to run something in the kernel instead of just userland.
  - forrestthewoods 5y ago
    I somewhat agree. Realistically I’m not sure it actually matters. In user mode they can do anything to my computer and steal any data they want. In kernel mode they can do it slightly more sneakily? Feels like one those things that sounds scarier than it actually is.
    - chlorion 5y ago
      Regular user mode software can be sandboxed by running the games in their their own user/graphical session dedicated to that specific game. Kernel mode software can by pass all security features implemented in the OS however. If you run everything in a single account what you say is true, but at least some people do use basic sandboxing methods like described above, which makes kernel-mode anti-cheat much more invasive.
chlorion 5y ago
This is exactly what I have been planning on setting up when I can save enough money for a new system, and when hardware is available again. It would be very unwise to entrust your main system to any of these companies, which is exactly what you are doing when installing modern anti-cheat software. Another option I have considered is setting up a gaming VM with GPU pass through. A totally separate system would be more secure, but the latency may be better with a VM, and working with VMs might be a bit more convenient I think. I have been curious about the security of hardware (or just GPU) pass through with VMs though, I am not sure how safe or dangerous giving direct hardware access could be in the worst case. There is the issue of some anti-cheat software detecting when it's being ran inside of a VM also.

Arcsech 5y ago

The shortcut to implementing this technique is buy a gaming console. Gaming companies seem very committed to their desire to root your box, so might as well just get one pre-rooted and use it for nothing else.

DangitBobby 5y ago
Games on PC are very cheap, though. I spend less for more games now than when I used consoles growing up.
- kbenson 5y ago
  There's lots of cheap indie games and game pass services on the consoles too, from what I understand. I'm not sure games on PC are much cheaper. Do you have examples of what you're talking about? Are big titles like $10 more on consoles for licensing fees or something?
  - stnikolauswagne 5y ago
    I think there are three arguments to be made for PC being overall cheaper 1) XBox Gamepass offers a huge library of often new games for a cheap rate. That service is also available on Xbox consoles but those are much less popular than their competition. 2) Epic Games offers a bunch of games for free to entice people into switching over from steam, not sure about the current situation though. 3) Steam often offers very deep discounts on games and due to the relative ease you can buy keys from resellers you can get games for super cheap. As an annectode I was able to get my girlfriend 250€ worth of expansions for sims for less than 40€, discounts this deep are hard to get on console.
- fomine3 5y ago
  Current gaming console itself is crazy cheap compared to gaming PC.
  - DangitBobby 5y ago
    Not at all. With sites like isthereanydeal.com and random and seasonal sales, I very rarely pay more than $25 for a game. My typical price for a game is $10 and one that I can play with all my friends inline would run about $15.
    - fomine3 5y ago
      Price for game is different story.
      - DangitBobby 5y ago
        I thought you said "console gaming" but you said "gaming console." Whoops.
    - Arcsech 5y ago
      Grandparent wasn't talking about the games, they were talking about the systems. If you can find one, a PS5 or XSX cost about $500. You can't buy very much gaming computer for $500.

nathanvanfleet 5y ago

Uh okay

NtGuy25 5y ago

It's not. Binary protection is easy and you won't be able to stop high level attackers. It's similar to the EDR field where it's monitoring heuristics and trying to correlate those to attacks. And it's also similar in that normally it functions off of a whitelist, but they get a bit more coverage since they only care about a singular program which they control. Companies get most of it from either filter drivers or ETW. Which effectively give a callback and notification for every handle or handle operation (So Networking, File, Registry, InterProcess, etc...). The good way to do this is ETW which gives you events and doesn't allow changing of these events, unlike a filter driver that can modify these requests. And this stops 99 % of people. ETW even runs in usermode as opposed to a driver. They also do malware techniques such as loading shellcode over the wire so it's difficult to audit the actual malicious stuff they're doing. There's zero reason for them to need anything like what Riot does with Vanguard and it's a joke that consumers allow this. It's them trying to jump to the top of the stack and abuse Kernel. But they're engineers are to stupid to realize this opens up complexity in the architecture and makes it easier to break and bypass.

kbenson 5y ago

They already have locked down special purpose gaming machines. They're called gaming consoles. Really, if keyboards and mice were more accepted components of those that developers always accounted for, I would just buy a console for gaming (except all my old games, but really, that wouldn't be hard to handle on a console either). It's already a little concerning to me that I play games on my main PC for the same reasons you most likely are worried about it. As it is, I try to keep it to things on Steam and the occasional old dosbox game from GOG, so at least I don't have to be hyper aware of all the different individual launcher capabilities.

zeta0134 5y ago

This is precisely why I own several game consoles. If I really want to play a game from known shady publishers (Ubisoft especially), it goes on the PS4 which has nothing on it that I actually care about. Go ahead, mess with Sony's OS, I don't care. But that nonsense does not touch my workstation.

andrepd 5y ago

You can always stop playing LoL :)

StreamBright 5y ago
Many of us did. :)

forrestthewoods 5y ago

How much random open source code do you compile and execute? How many programs do you run? At the end of the day it’s about trust. If you don’t trust Riot to run lol.exe then you definitely shouldn’t run their service! But if you trust Riot enough to run lol.exe it can do anything to your computer. The difference between lol.exe running in the foreground and something else running in the background is negligible from a security standpoint.

Crespyl 5y ago
Foreground or background I can agree with, but there's definitely a different level of trust involved if Riot wants to run something in the kernel instead of just userland.
- forrestthewoods 5y ago
  I somewhat agree. Realistically I’m not sure it actually matters. In user mode they can do anything to my computer and steal any data they want. In kernel mode they can do it slightly more sneakily? Feels like one those things that sounds scarier than it actually is.
  - chlorion 5y ago
    Regular user mode software can be sandboxed by running the games in their their own user/graphical session dedicated to that specific game. Kernel mode software can by pass all security features implemented in the OS however. If you run everything in a single account what you say is true, but at least some people do use basic sandboxing methods like described above, which makes kernel-mode anti-cheat much more invasive.

chlorion 5y ago

This is exactly what I have been planning on setting up when I can save enough money for a new system, and when hardware is available again. It would be very unwise to entrust your main system to any of these companies, which is exactly what you are doing when installing modern anti-cheat software. Another option I have considered is setting up a gaming VM with GPU pass through. A totally separate system would be more secure, but the latency may be better with a VM, and working with VMs might be a bit more convenient I think. I have been curious about the security of hardware (or just GPU) pass through with VMs though, I am not sure how safe or dangerous giving direct hardware access could be in the worst case. There is the issue of some anti-cheat software detecting when it's being ran inside of a VM also.