8 ms·

/dev/null: Anti-Cheat Kernel Driver (2020)

53 points by capableweb 4y ago

pilgrimfff 4y ago
No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/) What can they do next? Demand webcam access with your mouse visible, I guess?
- deleted 4y ago
  [deleted]
- mentos 4y ago
  I could see a webcam pointed at your hand/keyboard to verify input being something legit players would happily opt into.
  - Retr0id 4y ago
    This is already the standard for speedruns and high-score records for certain games. Partly just because it makes the recording more interesting to watch, but increasingly it's for evidence of not-cheating.
  - cowtools 4y ago
    Okay, but you couldn't just have a linux computer procedurally generating that video, then exposing itself to the host computer as a webcam over usb gadget driver? Not to mention that you would have to comb through all this footage to detect cheaters... It is honestly a laughable solution.
    - charcircuit 4y ago
      Yes, but writing a program to synthetically generate correct images will take a while to come out in which players can play without cheaters ruining games.
      - cowtools 4y ago
        Creating a system to automatically verify correct videos will take a while to come out, not to mention that it is extremely invasive for the end user and requires that they own all this extra equipment and bandwidth. The cheater does not even really need to generate fake video like I've described. Aimbots can be as subtle as the cheater wants them to be, offering <5% precision adjustments which won't be visible on a webcam. Not to mention that half of cheating is just information assistance like wallhacks which this doesn't even cover.
        mentos 4y ago
        What do you think is a better way to validate the input is legitimate?
        majewsky 4y ago
        The point is that the cheating problem is unsolvable at scale against sufficiently motivated attackers. It would be possible to solve if the incentives are not that strong to cheat, but the status game associated with multiplayer games takes care of the "sufficiently motivated part". It would be possible to solve at a small scale (e.g. at a tournament) by manually vetting hardware and manually reviewing footage. But preventing cheating at scale against motivated attackers is so expensive as to be uneconomical. The devs will probably try to install whatever malware they can get away with in order to demonstrate to their shareholders that they care about it, but I'm guessing even the devs will be relieved when Microsoft just blocks their kernel-level malware because they know the risks it entails.
        deleted 4y ago
        [deleted]
  - j245 4y ago
    So many problems with this idea.. Can you imagine your child saying “Mom / Dad I need to buy a webcam to play this game”. Alarm bells will be going off immediately. Financially speaking, every player needs to buy a webcam to play even a free to play game ? Do you need a camera of a specific quality ? What if the light in your room is off and the object detection can’t work out where your hand is ? Do you get kicked from the game because the sun went down and you didn’t turn on the light ? Can’t imagine the compute resources required to pull this off. The skins in the game will probably have to cost 10x more. This is just what comes to mind after thinking about this for 2 mins.
    - mentos 4y ago
      I imagine it would start with competitive leagues first and then slowly expand into mainstream if the technology proved itself.
      - j245 4y ago
        Can’t imagine a significant number of users ever accepting this solution, there’s too much hassle involved. Users who are not attempting world record attempts or playing tournaments where money or fame is on the line.. in other words.. 99.99% of the user base will have no incentive to bother with webcam hand recording anti-cheat systems. They will just move onto another less bothersome game that doesn’t require it, and that game will eat the webcam-required always recording game's market share.
        mentos 4y ago
        There will always be servers for the players that don’t care about hackers to play on. For the ones that are sick of having their games ruined by hackers they’ll angle their webcam down at their hands (or use the app on their smartphone) and join the server that supports it.
- maccard 4y ago
  The difference in effort, for a cheater, between installing a cheat as a user process and a kernel driver is about one button click. I can decide to cheat, stick my CC info into a website and download a program in less than 5 minutes. To get hardware I need to provide my shipping info and wait a couple of days. If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart. It's not an all or nothing thing, it's a game of cat and mouse. The aim isn't to completely stamp out cheaters at any cost, it's to raise the bar sufficiently high to make it so that enough games aren't destroyed by cheaters.
  - prvit 4y ago
    > If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart. Except perhaps the first few iterations, the hardware won’t be banned. You’ll just have to load a software update for your DMA hardware.
    - maccard 4y ago
      Great, so for the first few iterations hardware bans are effevtive!
      - prvit 4y ago
        Those first few iterations are already happening.
  - cowtools 4y ago
    How could the cheating hardware be banned? it is general-purpose, there is no change in the programming of the host computer that couldn't be combated by reprogramming the cheating device. Security-by-obscurity is a game of cat-and-mouse where the cat is blind and the mouse is invulnerable.
    - maccard 4y ago
      The hardware isn't banned, the player is banned if the anticheat detects the hardware being used. The hardware might be reprogrammable and self modifying at some point in the future, but until it is and it's widely available a root level anticheat is adequate protection.
- drdaeman 4y ago
  One dream is that I'll live long enough to see humans actually getting cybernetic enhancements and how much of a fuss that's gonna make on the gaming industry. In the same tune, I genuinely do want to see what Olympic Games could become if anything they consider "cheating" would be allowed - I honestly want to see what humans are actually capable of (though, of course, I won't be happy if people would ruin themselves over merely a silly goal of "winning"). I believe that - unlike most arms races in history (except the Space Race, I guess) - this kind of stuff is going to be actually beneficial for humanity. I'm not a smart guy, and probably there are some issues that I entirely miss (or maybe even not register as they don't match my beliefs), but that's a honest opinion. And yeah, I'm a sucker for science fiction.
- smileybarry 4y ago
  No, but the higher the moat the less cheaters you have. No anti-cheat is perfect or even blocks all cheaters, hell even console has aimbots thanks to console modding. It’s about reducing the amount, making it harder and preemptively banning people who go at it wrong, i.e.: using a known cheat. Better to have few cheaters than a million of them running baby’s-first-Python-script that just sends plain old WM_MOUSE.
prvit 4y ago
Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example: > Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk Kernel mode cheats do not require joining some guy’s botnet or installing a rootkit, even if they use similar techniques. If this claim was true, Riot would have every incentive to publish more detailed analysis in order to deter people from cheating. However, popular cheats aren’t malware, so they can’t do that. Instead, they’ll just stick to vague insinuations. It’s a lost battle anyway, DMA cheats keep getting better every day. They will inevitably render clientside anticheat obsolete.
- raggi 4y ago
  Is there somewhere with aggregate information from analysis of cheats and what they contain?
- charcircuit 4y ago
  >DMA cheats keep getting better every day These require buying physical harder instead of someone being able to just download a cheat for free. Also if you are writing memory to cheat / sending weird packets you can detect that and ban them.
  - prvit 4y ago
    > instead of someone being able to just download a cheat for free Decent hacks are already rather expensive, it’s not unusual for people to pay above $100/mo. > Also if you are writing memory to cheat […] you can detect that and ban them. There is no generic way to detect this.
    - runnerup 4y ago
      Many are around $50/mo too so people are spending $600/year on a subscription to keep the cheats up to date and patched.
forgotpwd16 4y ago
>2 years ago So (2020)? Also kinda funny a Unix-y element is referenced (/dev/null) whereas the target is only Windows.
josephcsible 4y ago
> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware, in the very same blog post where they tell you that from now on, they demand the ability to run their own third-party stuff in kernel mode on your machine.
- prvit 4y ago
  > So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware Which is utter nonsense. Nothing will touch this kernel mode stuff unless they’ve already owned your machine. All the data you care about is accessible from usermode anyway. The risks of kernel mode anticheat have been wildly overstated, Riot is engaging in the same to spread silly FUD regarding cheats.
  - ivegotnoaccount 4y ago
    At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials. I think on Windows, such actions lead to an overlay that ask for authorization and can't be auto-clicked ? If so, I think having such a prompt when not expected will rise attention from the tech-savy users which may report the culprit binary. A bug in the driver being exploited would lead to the absence of the symptom, potentially increasing the time before a first user notices it.
    - prvit 4y ago
      > At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials None of this matters, because all the files you care about live in your homedir anyway. In a desktop environment, the malware can tamper with your .profile to replace e.g. the sudo binary and gain root access without any exploits.
PaulsWallet 4y ago
> This isn’t giving us any surveillance capability we didn’t already have. I think this is an important line. Regardless of how people feel about anti-cheating efforts, I don't believe many people realize how much access games already have to their system to the point where it's kind of a miracle there aren't more malicious games out in the wild.
- ivegotnoaccount 4y ago
  Why limit your argument to games? All softwares that are ran without sandbox sadly have this issue. Any software could be malicious, not only games.
- lalopalota 4y ago
  Games? You mean literally every piece of software on (most) computers? Most default Windows, Linux, Mac single user setups are vulnerable to having everything be intercepted/exfiltrated by every program installed. Why would games be of concern specifically?
  - judge2020 4y ago
    Unless someone is 'that friend' that always tries to download shady programs and has tons of malicious extensions (previously toolbars) installed, I imagine most people are naive to the amount of potential harm desktop software can do; using common sense when browsing and sticking to typical programs (for games, Steam/third party big-name publishers' launchers) is very low-risk, so eventually you forget that any program could be stealing your browser cookies in an instant. Discord currently has this problem[0] where people send DMs stating 'will you playtest my game' and that exe just steals the user's stored Discord login token and uses it to proliferate the scam to more people, and/or uses the token to buy tons of gifted nitro. 0: https://www.reddit.com/r/discordapp/comments/s1f1vs/the_recent_try_my_game_discord_scam_explained/ https://www.reddit.com/r/discordapp/comments/s1f1vs/the_rece...
  - PaulsWallet 4y ago
    Because games are generally thought of as harmless. Most people aware a rogue piece of productivity software or something can cause them issues. Games, for whatever reason, don't get that same consideration.
intelVISA 4y ago
Good luck vs ring-3 DMA.
phendrenad2 4y ago
You basically can't have a PC game in 2022 without a kernel rootkit to detect cheating.
- maccard 4y ago
  Small caveat - multiplayer PC game.
- wswope 4y ago
  They’ve never actually rolled this out for League. I’ve played hundreds if not thousands of hours of competitive matches over a decade and never seen a blatant cheater (maybe 1-2 cass botters, but couldn’t be sure). Given that it’s one of the biggest online PvP games around, I don’t think you or Riot are really making a strong case here.
  - stryan 4y ago
    I believe this is referring to Vanguard, the anti-cheat Valorant uses that at some point is supposed to come to League.
  - phendrenad2 4y ago
    To understand why it's a strong argument, you have to understand the difference between 2D games like League and 3D games like Valorant. In a 2D game, the game is slow enough that you can keep most of the state server-side. The potential to cheat in League is very low. Things you might want to do include (1) macros to do combos (2) automatically run away when low health (3) bigger alerts when an enemy is charging your lane (4) skillshot aiming. None of those are going to really push you up in rank. You'd be better off just getting good at them yourself, as you'll have more flexibility than relying on a tool to do them for you (and then having to fight the tool when you don't want them). A 3D game like Valorant or Call of Duty is much more fast-paced and also introduces a third dimension. This means that transferring the visible game state to the player every frame is much more difficult, both for the server to keep track of, and for the network bandwidth available to the players. This means that in 3D games, there is often client-side data that the user is not supposed to see (such as the exact position of an enemy who has ducked behind a wall, but the server hasn't stopped sending you position data for yet). This poses a huge advantage to whoever can get access to that data and display it somehow. These are called cheats... And they can run in kernel space. This is why they need their own kernel rootkit to detect them. This article seems to be a bit unclear, but it seems like their point is to justify kernel-mode anti-cheat in broad strokes. I don't think they're just talking about League here. Adding anti-cheat to League is probably not a priority, for reasons I've outlined above.
etaioinshrdlu 4y ago
Does Microsoft have to approve these drivers? I would argue Microsoft should not allow this kind of thing if they really want to provide security. Apple would never approve such a mechanism, for sure.
- maccard 4y ago
  For Microsoft you need a code signing certificate [0], shell out about $500 and to follow some instructions. Apple do allow this through kernel extensions, but its very much opt in from users. [0] https://docs.microsoft.com/en-us/windows-hardware/drivers/develop/signing-a-driver-for-public-release https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
  - judge2020 4y ago
    While i'm not sure if it works for device drivers, Microsoft is working on Azure Code Signing, which moves it from third-party vendors to MS directly. For Apple, kexts have been deprecated for a while, with more modern APIs available for ensuring privacy and security in device drivers[1]. 1: https://developer.apple.com/support/kernel-extensions/ https://developer.apple.com/support/kernel-extensions/
    - maccard 4y ago
      But kexts are only deprecated and not removed. Someone having enabled kexts is just as likely to be cheating as they are using an old audio interface device with their DAW. Edit: good to know about MS, I didn't actually know that!
deleted 4y ago
[deleted]
midislack 4y ago
slaymaker1907 4y ago
This is very concerning. Installers on Windows in 2022 should not even require admin permission (only elevating if a user wants to install for all users). What if Riot had a supply chain attack and someone attached something far more malicious to the kernel?
- maccard 4y ago
  What damage do you expect they will do with kernel access that they won't do with admin access?
neilv 4y ago
Due to cheaters, anti-cheats, and a general trend towards invasiveness... I've been thinking that individuals compartmentalizing gaming to dedicated machines (e.g., gaming consoles, dedicated PC gaming rigs) is a good idea. Separating out the requirement to run games, from the general-purpose computing requirements, opens up more options. It also pushes fewer people towards buying into Windows way of life for everything desktop/laptop.
- maccard 4y ago
  It's a fantastic idea, and the reason I own a console. The extra advantage of consoles is that both I and the developers know that the other players on my platform are all on locked down hardware so measures like this are unnecessary for everyone.
mart2d2 4y ago
After spending enough years fighting spammers and fraudsters, short of having an aggressive anti-cheating operations team (which can work great, but is of course expensive to operate), our spam strategies pointing to really one solution: making it more expensive to lose an account. This is why I think consoles are winning (too expensive to get banned) and why I thought VAC secure made a lot of sense (as long as the game isn't free - precisely why TF2 is now a bot haven). There needs to be some skin in the game that the cheater will lose if they get banned. Even the chance that they'll get detected deters them (which is absolutely fantastic when you consider the battle from an OODA loops perspective).
10000truths 4y ago
What a load of baloney. It's an open secret that client side cheat detection is a losing battle, and yet many games still persist with these unacceptably hacky half measures. The correct approach has always been to perform the cheat detection on the server side and use statistical analysis to detect and ban cheaters. No brittle assumptions about client environment resulting in potential breakages or false bans. No invasive rootkits that could compromise your users' machines. No opportunity for the client to reverse engineer or instrument the binary to patch out the cheat detection methods.
- maccard 4y ago
  > yet many games still persist with these unacceptably hacky half measures. Unfortunately what you're suggesting is a hacky half measure. From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players. > No brittle assumptions about client environment resulting in potential breakages or false bans. Let's be honest, server side anticheat is no less susceptible to this than client side. If you're banning on heuristics there's going to be false bans at some point, and you are making assumptions about a perfect client environment with this approach. > No opportunity for the client to reverse engineer or instrument the binary to patch out the cheat detection methods. Except you can analyse the ban rates based on how "aggressive" your cheat is across all your players and adjust the effectiveness to keep it under that threshold. If we're going to make the claim that cheaters can always adapt to client side cheats, we can make the same claim for server side cheats.
  - 10000truths 4y ago
    > From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players. Lag switching is only one kind of cheat that applies mainly to multiplayer FPS games, and as I said, it can be mitigated through statistical analysis. A simple method would be to kick players (but not ban) from a match if they have too many latency spikes. A better method would be to analyze how often a player's latency spikes coincide with their kills, and ban them if there is excessive correlation. You are right that preventing any and all forms of cheating is impossible, especially where such methods would negatively impact the player experience. But a perfect solution isn't necessary. Issuing bans after the fact is still effective, as long as the cheaters don't make too much progress or otherwise cause too much impact within that time frame. > Let's be honest, server side anticheat is no less susceptible to this than client side. If you're banning on heuristics there's going to be false bans at some point, and you are making assumptions about a perfect client environment with this approach. But that tradeoff is entirely under your control. With server side heuristics, you are in a better position to understand how it works and document it so that others on your team understand it as well. You can tweak its parameters and specialize it with assumptions specific to your game mechanics, and minimize false positives to some probability interval. You can identify specific cheating patterns (e.g. perfectly tracking an enemy behind walls long since the enemy is last seen) and tailor your heuristic to detect such cases. You can feed it more sample data to increase its accuracy. You can set up processes to verify ambiguous cases with human moderators in the loop. None of this requires any assumptions about the client environment, it only requires analyzing the player inputs received by the server over the network. Client side heuristics, on the other hand, tend to be based on things that serve as rather poor proxies for cheating. Running the game in a virtual machine? Banned. Running the client in WINE on Linux? Banned. Driver signature enforcement disabled? Flagged. User running AutoHotKey or WinDbg or Ghidra? Flagged. New Windows update that breaks some internal NT kernel ABI that my anti-cheat rootkit was relying on? Uh oh. These detection methods are better than nothing, but heavy reliance on them has made it easy for cheaters to circumvent anti-cheats while still causing issues for legitimate players whose setup might deviate slightly from the norm. > Except you can analyse the ban rates based on how "aggressive" your cheat is across all your players and adjust the effectiveness to keep it under that threshold. If we're going to make the claim that cheaters can always adapt to client side cheats, we can make the same claim for server side cheats. While true, this sort of signal carries much less information than what you can gain from reverse engineering client side cheat detection. You can make it more difficult by issuing ban waves at fixed intervals, and slightly varying the thresholds by some small random amount each time. Larger ban wave intervals mean that it takes longer for cheaters to infer the behavior of your server side anti-cheat, at the cost of taking longer to ban cheaters. But again, that tradeoff is under your control.
ok123456 4y ago
Doesn't every machine with thunderbolt have the ability to have its memory edited undetectably?
- josephcsible 4y ago
  Don't IOMMU's prevent that these days?
  - ok123456 4y ago
    That's not much protection, as it pertains to "trusted computing," if it can be silently turned on or off as a bios setting.
folkrav 4y ago
Seeing how many cheaters there still is are on Valorant (where they already employ such techniques), I really doubt this is helping much. But yay, let's keep pushing more and more intrusive software on user's computers.
shmerl 4y ago
Simply disgusting to see someone trying to find excuses for usage of outright malware with arguments like "users shouldn't care anyway".
robalni 4y ago
This is a pattern I see very often and that I think all of us can see all the time. The developers of software try to control how the users use the software. This is not just a regular customer or user relationship between the user and the developer. This is something else, some kind of controlling behavior that we need to get rid of. You can't force someone to stop doing something as long as they do it on their own computer. You have to choose; either people use your computer with your rules or they use their own computer with their rules. If players want to cheat, that's the player's problem, not the developer's problem.
- smileybarry 4y ago
  …and on that same note, the developers have total say over what someone does on their computer — the server.
  - robalni 4y ago
    No player runs code on the developer's server. They just send packets to it, just like my web browser sends packets to web servers. Nobody is trying to put anti-cheat software in my web browser.
    - smileybarry 4y ago
      So? You’re still using their server. They can choose to require you to follow certain rules to do so.
      - robalni 4y ago
        They can choose the server rules but I choose what code runs on my computer.
        smileybarry 4y ago
        My point is that they can stipulate to run their code on your computer if you wish to connect to their server — which is the current situation. If you uninstall/disable anticheats, the server declines your connection.
Youden 4y ago
Riot's anti cheat is the only one I've found that causes my KVM virtual machine running Windows to BSoD. Ironic that the post title indicates Linux-awareness but the post content breaks any chance of playing Riot's games on a Linux computer.
- smileybarry 4y ago
  Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.
  - Youden 4y ago
    Yes, I know Riot has stated that VMs aren't supported. I'm no expert on anti-cheat but other popular games (e.g. Apex Legends) run without BSoD and as far as I can see don't have serious issues with cheating. I don't think this is an issue of technical necessity so much as an issue of there being very few Linux gamers and even fewer using something like VFIO to run games rather than dual-booting.
    - smileybarry 4y ago
      Apex Legends has its own troubles of cheating but it’s less seen because it’s a battle royale game, you spectate them “once” compared to playing 20-so rounds against a cheater. And IIRC Vanguard is purposefully strict.
  - EE84M3i 4y ago
    Does this mean you have to disable Hyper-V to run LoL?
    - smileybarry 4y ago
      No, League doesn’t use Vanguard to begin with, and Hyper-V is excepted because your OS is the root VM, i.e. another VM can’t manage it. Just LSASS and such, and they’re trusted.
sylware 4y ago
dota2: overwatch. With the right data, nice users and probably a bit of ML...
aussieshibe 4y ago
Putting aside the technical aspect, the tone of this post feels familiar to me. In one of my earlier roles, I was responsible for a system used to filter internet access for about a million school students. The students were absolutely easily able to bypass our filtering in a bunch of ways we could not address, as we had no control over the client devices. Being a team of professionals in a situation where we were constantly being defeated by a bunch of kids felt humiliating, even as we acknowledged the uneven battleground we were fighting on. I suspect a similar feeling was behind this blog post. Why else say things like "as much as we might like the idea of an ever-escalating appsec war with teenagers"? This comes off as bitter and insincere to me. As though they're trying to put down their adversary while simultaneously acknowledging they're losing the battle and need to deploy the nuclear option. Edit: not that "teenager" is necessarily a put down. If there's one thing I learned from that job, it's that teenagers are incredibly resourceful.
pabs3 4y ago
I wonder if their anti-cheats will work on Linux and if they will be GPL compliant.
oliwarner 4y ago
It's infuriating that developers still espouse this secure client method. It doesn't work. You just chase the cheats higher and higher up the stack and once they're in the hardware, you're boned. And they're already in the hardware. Between direct memory access and actually external AI devices, people can cheat. So either audit client actions to make sure they only do what they can do (via peers and server) or do the rendering server-side to stop information leaks. Anything else is dishonest and a waste of everyone's time and safety.

53 points by capableweb 4y ago

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/) What can they do next? Demand webcam access with your mouse visible, I guess?

deleted 4y ago
[deleted]
mentos 4y ago
I could see a webcam pointed at your hand/keyboard to verify input being something legit players would happily opt into.
- Retr0id 4y ago
  This is already the standard for speedruns and high-score records for certain games. Partly just because it makes the recording more interesting to watch, but increasingly it's for evidence of not-cheating.
- cowtools 4y ago
  Okay, but you couldn't just have a linux computer procedurally generating that video, then exposing itself to the host computer as a webcam over usb gadget driver? Not to mention that you would have to comb through all this footage to detect cheaters... It is honestly a laughable solution.
  - charcircuit 4y ago
    Yes, but writing a program to synthetically generate correct images will take a while to come out in which players can play without cheaters ruining games.
    - cowtools 4y ago
      Creating a system to automatically verify correct videos will take a while to come out, not to mention that it is extremely invasive for the end user and requires that they own all this extra equipment and bandwidth. The cheater does not even really need to generate fake video like I've described. Aimbots can be as subtle as the cheater wants them to be, offering <5% precision adjustments which won't be visible on a webcam. Not to mention that half of cheating is just information assistance like wallhacks which this doesn't even cover.
      - mentos 4y ago
        What do you think is a better way to validate the input is legitimate?
        majewsky 4y ago
        The point is that the cheating problem is unsolvable at scale against sufficiently motivated attackers. It would be possible to solve if the incentives are not that strong to cheat, but the status game associated with multiplayer games takes care of the "sufficiently motivated part". It would be possible to solve at a small scale (e.g. at a tournament) by manually vetting hardware and manually reviewing footage. But preventing cheating at scale against motivated attackers is so expensive as to be uneconomical. The devs will probably try to install whatever malware they can get away with in order to demonstrate to their shareholders that they care about it, but I'm guessing even the devs will be relieved when Microsoft just blocks their kernel-level malware because they know the risks it entails.
        deleted 4y ago
        [deleted]
- j245 4y ago
  So many problems with this idea.. Can you imagine your child saying “Mom / Dad I need to buy a webcam to play this game”. Alarm bells will be going off immediately. Financially speaking, every player needs to buy a webcam to play even a free to play game ? Do you need a camera of a specific quality ? What if the light in your room is off and the object detection can’t work out where your hand is ? Do you get kicked from the game because the sun went down and you didn’t turn on the light ? Can’t imagine the compute resources required to pull this off. The skins in the game will probably have to cost 10x more. This is just what comes to mind after thinking about this for 2 mins.
  - mentos 4y ago
    I imagine it would start with competitive leagues first and then slowly expand into mainstream if the technology proved itself.
    - j245 4y ago
      Can’t imagine a significant number of users ever accepting this solution, there’s too much hassle involved. Users who are not attempting world record attempts or playing tournaments where money or fame is on the line.. in other words.. 99.99% of the user base will have no incentive to bother with webcam hand recording anti-cheat systems. They will just move onto another less bothersome game that doesn’t require it, and that game will eat the webcam-required always recording game's market share.
      - mentos 4y ago
        There will always be servers for the players that don’t care about hackers to play on. For the ones that are sick of having their games ruined by hackers they’ll angle their webcam down at their hands (or use the app on their smartphone) and join the server that supports it.
maccard 4y ago
The difference in effort, for a cheater, between installing a cheat as a user process and a kernel driver is about one button click. I can decide to cheat, stick my CC info into a website and download a program in less than 5 minutes. To get hardware I need to provide my shipping info and wait a couple of days. If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart. It's not an all or nothing thing, it's a game of cat and mouse. The aim isn't to completely stamp out cheaters at any cost, it's to raise the bar sufficiently high to make it so that enough games aren't destroyed by cheaters.
- prvit 4y ago
  > If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart. Except perhaps the first few iterations, the hardware won’t be banned. You’ll just have to load a software update for your DMA hardware.
  - maccard 4y ago
    Great, so for the first few iterations hardware bans are effevtive!
    - prvit 4y ago
      Those first few iterations are already happening.
- cowtools 4y ago
  How could the cheating hardware be banned? it is general-purpose, there is no change in the programming of the host computer that couldn't be combated by reprogramming the cheating device. Security-by-obscurity is a game of cat-and-mouse where the cat is blind and the mouse is invulnerable.
  - maccard 4y ago
    The hardware isn't banned, the player is banned if the anticheat detects the hardware being used. The hardware might be reprogrammable and self modifying at some point in the future, but until it is and it's widely available a root level anticheat is adequate protection.
drdaeman 4y ago
One dream is that I'll live long enough to see humans actually getting cybernetic enhancements and how much of a fuss that's gonna make on the gaming industry. In the same tune, I genuinely do want to see what Olympic Games could become if anything they consider "cheating" would be allowed - I honestly want to see what humans are actually capable of (though, of course, I won't be happy if people would ruin themselves over merely a silly goal of "winning"). I believe that - unlike most arms races in history (except the Space Race, I guess) - this kind of stuff is going to be actually beneficial for humanity. I'm not a smart guy, and probably there are some issues that I entirely miss (or maybe even not register as they don't match my beliefs), but that's a honest opinion. And yeah, I'm a sucker for science fiction.
smileybarry 4y ago
No, but the higher the moat the less cheaters you have. No anti-cheat is perfect or even blocks all cheaters, hell even console has aimbots thanks to console modding. It’s about reducing the amount, making it harder and preemptively banning people who go at it wrong, i.e.: using a known cheat. Better to have few cheaters than a million of them running baby’s-first-Python-script that just sends plain old WM_MOUSE.

prvit 4y ago

Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example: > Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk Kernel mode cheats do not require joining some guy’s botnet or installing a rootkit, even if they use similar techniques. If this claim was true, Riot would have every incentive to publish more detailed analysis in order to deter people from cheating. However, popular cheats aren’t malware, so they can’t do that. Instead, they’ll just stick to vague insinuations. It’s a lost battle anyway, DMA cheats keep getting better every day. They will inevitably render clientside anticheat obsolete.

raggi 4y ago
Is there somewhere with aggregate information from analysis of cheats and what they contain?
charcircuit 4y ago
>DMA cheats keep getting better every day These require buying physical harder instead of someone being able to just download a cheat for free. Also if you are writing memory to cheat / sending weird packets you can detect that and ban them.
- prvit 4y ago
  > instead of someone being able to just download a cheat for free Decent hacks are already rather expensive, it’s not unusual for people to pay above $100/mo. > Also if you are writing memory to cheat […] you can detect that and ban them. There is no generic way to detect this.
  - runnerup 4y ago
    Many are around $50/mo too so people are spending $600/year on a subscription to keep the cheats up to date and patched.

forgotpwd16 4y ago

>2 years ago So (2020)? Also kinda funny a Unix-y element is referenced (/dev/null) whereas the target is only Windows.

josephcsible 4y ago

> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware, in the very same blog post where they tell you that from now on, they demand the ability to run their own third-party stuff in kernel mode on your machine.

prvit 4y ago
> So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware Which is utter nonsense. Nothing will touch this kernel mode stuff unless they’ve already owned your machine. All the data you care about is accessible from usermode anyway. The risks of kernel mode anticheat have been wildly overstated, Riot is engaging in the same to spread silly FUD regarding cheats.
- ivegotnoaccount 4y ago
  At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials. I think on Windows, such actions lead to an overlay that ask for authorization and can't be auto-clicked ? If so, I think having such a prompt when not expected will rise attention from the tech-savy users which may report the culprit binary. A bug in the driver being exploited would lead to the absence of the symptom, potentially increasing the time before a first user notices it.
  - prvit 4y ago
    > At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials None of this matters, because all the files you care about live in your homedir anyway. In a desktop environment, the malware can tamper with your .profile to replace e.g. the sudo binary and gain root access without any exploits.

PaulsWallet 4y ago

> This isn’t giving us any surveillance capability we didn’t already have. I think this is an important line. Regardless of how people feel about anti-cheating efforts, I don't believe many people realize how much access games already have to their system to the point where it's kind of a miracle there aren't more malicious games out in the wild.

ivegotnoaccount 4y ago
Why limit your argument to games? All softwares that are ran without sandbox sadly have this issue. Any software could be malicious, not only games.
lalopalota 4y ago
Games? You mean literally every piece of software on (most) computers? Most default Windows, Linux, Mac single user setups are vulnerable to having everything be intercepted/exfiltrated by every program installed. Why would games be of concern specifically?
- judge2020 4y ago
  Unless someone is 'that friend' that always tries to download shady programs and has tons of malicious extensions (previously toolbars) installed, I imagine most people are naive to the amount of potential harm desktop software can do; using common sense when browsing and sticking to typical programs (for games, Steam/third party big-name publishers' launchers) is very low-risk, so eventually you forget that any program could be stealing your browser cookies in an instant. Discord currently has this problem[0] where people send DMs stating 'will you playtest my game' and that exe just steals the user's stored Discord login token and uses it to proliferate the scam to more people, and/or uses the token to buy tons of gifted nitro. 0: https://www.reddit.com/r/discordapp/comments/s1f1vs/the_recent_try_my_game_discord_scam_explained/ https://www.reddit.com/r/discordapp/comments/s1f1vs/the_rece...
- PaulsWallet 4y ago
  Because games are generally thought of as harmless. Most people aware a rogue piece of productivity software or something can cause them issues. Games, for whatever reason, don't get that same consideration.

intelVISA 4y ago

Good luck vs ring-3 DMA.

phendrenad2 4y ago

You basically can't have a PC game in 2022 without a kernel rootkit to detect cheating.

maccard 4y ago
Small caveat - multiplayer PC game.
wswope 4y ago
They’ve never actually rolled this out for League. I’ve played hundreds if not thousands of hours of competitive matches over a decade and never seen a blatant cheater (maybe 1-2 cass botters, but couldn’t be sure). Given that it’s one of the biggest online PvP games around, I don’t think you or Riot are really making a strong case here.
- stryan 4y ago
  I believe this is referring to Vanguard, the anti-cheat Valorant uses that at some point is supposed to come to League.
- phendrenad2 4y ago
  To understand why it's a strong argument, you have to understand the difference between 2D games like League and 3D games like Valorant. In a 2D game, the game is slow enough that you can keep most of the state server-side. The potential to cheat in League is very low. Things you might want to do include (1) macros to do combos (2) automatically run away when low health (3) bigger alerts when an enemy is charging your lane (4) skillshot aiming. None of those are going to really push you up in rank. You'd be better off just getting good at them yourself, as you'll have more flexibility than relying on a tool to do them for you (and then having to fight the tool when you don't want them). A 3D game like Valorant or Call of Duty is much more fast-paced and also introduces a third dimension. This means that transferring the visible game state to the player every frame is much more difficult, both for the server to keep track of, and for the network bandwidth available to the players. This means that in 3D games, there is often client-side data that the user is not supposed to see (such as the exact position of an enemy who has ducked behind a wall, but the server hasn't stopped sending you position data for yet). This poses a huge advantage to whoever can get access to that data and display it somehow. These are called cheats... And they can run in kernel space. This is why they need their own kernel rootkit to detect them. This article seems to be a bit unclear, but it seems like their point is to justify kernel-mode anti-cheat in broad strokes. I don't think they're just talking about League here. Adding anti-cheat to League is probably not a priority, for reasons I've outlined above.

etaioinshrdlu 4y ago

Does Microsoft have to approve these drivers? I would argue Microsoft should not allow this kind of thing if they really want to provide security. Apple would never approve such a mechanism, for sure.

maccard 4y ago
For Microsoft you need a code signing certificate [0], shell out about $500 and to follow some instructions. Apple do allow this through kernel extensions, but its very much opt in from users. [0] https://docs.microsoft.com/en-us/windows-hardware/drivers/develop/signing-a-driver-for-public-release https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
- judge2020 4y ago
  While i'm not sure if it works for device drivers, Microsoft is working on Azure Code Signing, which moves it from third-party vendors to MS directly. For Apple, kexts have been deprecated for a while, with more modern APIs available for ensuring privacy and security in device drivers[1]. 1: https://developer.apple.com/support/kernel-extensions/ https://developer.apple.com/support/kernel-extensions/
  - maccard 4y ago
    But kexts are only deprecated and not removed. Someone having enabled kexts is just as likely to be cheating as they are using an old audio interface device with their DAW. Edit: good to know about MS, I didn't actually know that!

deleted 4y ago

[deleted]

midislack 4y ago

slaymaker1907 4y ago

This is very concerning. Installers on Windows in 2022 should not even require admin permission (only elevating if a user wants to install for all users). What if Riot had a supply chain attack and someone attached something far more malicious to the kernel?

maccard 4y ago
What damage do you expect they will do with kernel access that they won't do with admin access?

neilv 4y ago

Due to cheaters, anti-cheats, and a general trend towards invasiveness... I've been thinking that individuals compartmentalizing gaming to dedicated machines (e.g., gaming consoles, dedicated PC gaming rigs) is a good idea. Separating out the requirement to run games, from the general-purpose computing requirements, opens up more options. It also pushes fewer people towards buying into Windows way of life for everything desktop/laptop.

maccard 4y ago
It's a fantastic idea, and the reason I own a console. The extra advantage of consoles is that both I and the developers know that the other players on my platform are all on locked down hardware so measures like this are unnecessary for everyone.

mart2d2 4y ago

After spending enough years fighting spammers and fraudsters, short of having an aggressive anti-cheating operations team (which can work great, but is of course expensive to operate), our spam strategies pointing to really one solution: making it more expensive to lose an account. This is why I think consoles are winning (too expensive to get banned) and why I thought VAC secure made a lot of sense (as long as the game isn't free - precisely why TF2 is now a bot haven). There needs to be some skin in the game that the cheater will lose if they get banned. Even the chance that they'll get detected deters them (which is absolutely fantastic when you consider the battle from an OODA loops perspective).

10000truths 4y ago

What a load of baloney. It's an open secret that client side cheat detection is a losing battle, and yet many games still persist with these unacceptably hacky half measures. The correct approach has always been to perform the cheat detection on the server side and use statistical analysis to detect and ban cheaters. No brittle assumptions about client environment resulting in potential breakages or false bans. No invasive rootkits that could compromise your users' machines. No opportunity for the client to reverse engineer or instrument the binary to patch out the cheat detection methods.

maccard 4y ago
> yet many games still persist with these unacceptably hacky half measures. Unfortunately what you're suggesting is a hacky half measure. From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players. > No brittle assumptions about client environment resulting in potential breakages or false bans. Let's be honest, server side anticheat is no less susceptible to this than client side. If you're banning on heuristics there's going to be false bans at some point, and you are making assumptions about a perfect client environment with this approach. > No opportunity for the client to reverse engineer or instrument the binary to patch out the cheat detection methods. Except you can analyse the ban rates based on how "aggressive" your cheat is across all your players and adjust the effectiveness to keep it under that threshold. If we're going to make the claim that cheaters can always adapt to client side cheats, we can make the same claim for server side cheats.
- 10000truths 4y ago
  > From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players. Lag switching is only one kind of cheat that applies mainly to multiplayer FPS games, and as I said, it can be mitigated through statistical analysis. A simple method would be to kick players (but not ban) from a match if they have too many latency spikes. A better method would be to analyze how often a player's latency spikes coincide with their kills, and ban them if there is excessive correlation. You are right that preventing any and all forms of cheating is impossible, especially where such methods would negatively impact the player experience. But a perfect solution isn't necessary. Issuing bans after the fact is still effective, as long as the cheaters don't make too much progress or otherwise cause too much impact within that time frame. > Let's be honest, server side anticheat is no less susceptible to this than client side. If you're banning on heuristics there's going to be false bans at some point, and you are making assumptions about a perfect client environment with this approach. But that tradeoff is entirely under your control. With server side heuristics, you are in a better position to understand how it works and document it so that others on your team understand it as well. You can tweak its parameters and specialize it with assumptions specific to your game mechanics, and minimize false positives to some probability interval. You can identify specific cheating patterns (e.g. perfectly tracking an enemy behind walls long since the enemy is last seen) and tailor your heuristic to detect such cases. You can feed it more sample data to increase its accuracy. You can set up processes to verify ambiguous cases with human moderators in the loop. None of this requires any assumptions about the client environment, it only requires analyzing the player inputs received by the server over the network. Client side heuristics, on the other hand, tend to be based on things that serve as rather poor proxies for cheating. Running the game in a virtual machine? Banned. Running the client in WINE on Linux? Banned. Driver signature enforcement disabled? Flagged. User running AutoHotKey or WinDbg or Ghidra? Flagged. New Windows update that breaks some internal NT kernel ABI that my anti-cheat rootkit was relying on? Uh oh. These detection methods are better than nothing, but heavy reliance on them has made it easy for cheaters to circumvent anti-cheats while still causing issues for legitimate players whose setup might deviate slightly from the norm. > Except you can analyse the ban rates based on how "aggressive" your cheat is across all your players and adjust the effectiveness to keep it under that threshold. If we're going to make the claim that cheaters can always adapt to client side cheats, we can make the same claim for server side cheats. While true, this sort of signal carries much less information than what you can gain from reverse engineering client side cheat detection. You can make it more difficult by issuing ban waves at fixed intervals, and slightly varying the thresholds by some small random amount each time. Larger ban wave intervals mean that it takes longer for cheaters to infer the behavior of your server side anti-cheat, at the cost of taking longer to ban cheaters. But again, that tradeoff is under your control.

ok123456 4y ago

Doesn't every machine with thunderbolt have the ability to have its memory edited undetectably?

josephcsible 4y ago
Don't IOMMU's prevent that these days?
- ok123456 4y ago
  That's not much protection, as it pertains to "trusted computing," if it can be silently turned on or off as a bios setting.

folkrav 4y ago

Seeing how many cheaters there still is are on Valorant (where they already employ such techniques), I really doubt this is helping much. But yay, let's keep pushing more and more intrusive software on user's computers.

shmerl 4y ago

Simply disgusting to see someone trying to find excuses for usage of outright malware with arguments like "users shouldn't care anyway".

robalni 4y ago

This is a pattern I see very often and that I think all of us can see all the time. The developers of software try to control how the users use the software. This is not just a regular customer or user relationship between the user and the developer. This is something else, some kind of controlling behavior that we need to get rid of. You can't force someone to stop doing something as long as they do it on their own computer. You have to choose; either people use your computer with your rules or they use their own computer with their rules. If players want to cheat, that's the player's problem, not the developer's problem.

smileybarry 4y ago
…and on that same note, the developers have total say over what someone does on their computer — the server.
- robalni 4y ago
  No player runs code on the developer's server. They just send packets to it, just like my web browser sends packets to web servers. Nobody is trying to put anti-cheat software in my web browser.
  - smileybarry 4y ago
    So? You’re still using their server. They can choose to require you to follow certain rules to do so.
    - robalni 4y ago
      They can choose the server rules but I choose what code runs on my computer.
      - smileybarry 4y ago
        My point is that they can stipulate to run their code on your computer if you wish to connect to their server — which is the current situation. If you uninstall/disable anticheats, the server declines your connection.

Youden 4y ago

Riot's anti cheat is the only one I've found that causes my KVM virtual machine running Windows to BSoD. Ironic that the post title indicates Linux-awareness but the post content breaks any chance of playing Riot's games on a Linux computer.

smileybarry 4y ago
Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.
- Youden 4y ago
  Yes, I know Riot has stated that VMs aren't supported. I'm no expert on anti-cheat but other popular games (e.g. Apex Legends) run without BSoD and as far as I can see don't have serious issues with cheating. I don't think this is an issue of technical necessity so much as an issue of there being very few Linux gamers and even fewer using something like VFIO to run games rather than dual-booting.
  - smileybarry 4y ago
    Apex Legends has its own troubles of cheating but it’s less seen because it’s a battle royale game, you spectate them “once” compared to playing 20-so rounds against a cheater. And IIRC Vanguard is purposefully strict.
- EE84M3i 4y ago
  Does this mean you have to disable Hyper-V to run LoL?
  - smileybarry 4y ago
    No, League doesn’t use Vanguard to begin with, and Hyper-V is excepted because your OS is the root VM, i.e. another VM can’t manage it. Just LSASS and such, and they’re trusted.

sylware 4y ago

dota2: overwatch. With the right data, nice users and probably a bit of ML...

aussieshibe 4y ago

Putting aside the technical aspect, the tone of this post feels familiar to me. In one of my earlier roles, I was responsible for a system used to filter internet access for about a million school students. The students were absolutely easily able to bypass our filtering in a bunch of ways we could not address, as we had no control over the client devices. Being a team of professionals in a situation where we were constantly being defeated by a bunch of kids felt humiliating, even as we acknowledged the uneven battleground we were fighting on. I suspect a similar feeling was behind this blog post. Why else say things like "as much as we might like the idea of an ever-escalating appsec war with teenagers"? This comes off as bitter and insincere to me. As though they're trying to put down their adversary while simultaneously acknowledging they're losing the battle and need to deploy the nuclear option. Edit: not that "teenager" is necessarily a put down. If there's one thing I learned from that job, it's that teenagers are incredibly resourceful.

pabs3 4y ago

I wonder if their anti-cheats will work on Linux and if they will be GPL compliant.

oliwarner 4y ago

It's infuriating that developers still espouse this secure client method. It doesn't work. You just chase the cheats higher and higher up the stack and once they're in the hardware, you're boned. And they're already in the hardware. Between direct memory access and actually external AI devices, people can cheat. So either audit client actions to make sure they only do what they can do (via peers and server) or do the rendering server-side to stop information leaks. Anything else is dishonest and a waste of everyone's time and safety.