6 ms·
EA announces kernel-level anti-cheat system for PC games
- nradov 4y agoAny bets on how long it will take hackers to find a security exploit in this crap? Anything running at kernel level is going to be a prime target.
- gjsman-1000 4y agoIf they use remote attestation, it will be basically irrelevant if they do from EA’s perspective.
- robswc 4y agowould this be similar to the way having server-side logic only makes hacking significantly more difficult? Or is it sorta a "game over" from the hackers perspective, at least for awhile?
- josephcsible 4y agoGiven the track record with other games' kernel-level anti-cheat, probably not very long.
- stoicjumbotron 4y agoIs there any good write-up or a video series where the hacker explains how they bypassed DRM or some other anti cheat system?
- eswat 4y agoA bit old but there’s this writeup on bypassing BattlEye: https://secret.club/2020/07/06/bottleye.html https://secret.club/2020/07/06/bottleye.html
- sascha_sl 4y agoFun fact: Early on into Vanguard, Valorant's Anticheat, some system monitoring software would not run at all - even with Valorant not running, because cheaters used a vulnerable kernel module included with that software to get their code into kernel mode.
- smoldesu 4y ago> EA says kernel-level protection is “absolutely vital” for competitive games like FIFA 23, as existing cheats operate in the kernel space, so games running in regular user mode can’t detect that tampering or cheating is occurring. There are soccer games from the 90s that didn't need to run in Ring 0.
- sensitivefrost 4y agoYeah but to be fair, those games were nowhere nearly as popular as FIFA is today both casually and competitively.
- honkycat 4y agoGross. Also a recipe for disaster. However: As a "gamer", I have to say: We are running out of options for anti-cheat. The cheaters are EVERYWHERE in games like Destiny 2, Fortnite, CS: GO, New World... any popular online game, the cheaters are in 1/10 matches ruining your fun. Weather or not a kernel level anti-cheat will help? Probably not. It is unfortunate that a lot of lower information consumers are going to install this crap onto their PCs.
- josephcsible 4y agoA lot of games already have kernel-level anti-cheat. Was it successful in fixing the cheating problem for any of them?
- tapoxi 4y agoValorant's anti-cheat has been very successful (Riot Vanguard) but it is also an early mode kernel driver, so it can load before any potential cheat driver. I think Microsoft should just ship an anti-cheat API as part of Windows so games stop relying on kernel drivers.
- mildmotive 4y agoThis kind of anti-cheat would contradict the idea of having control over your own computer. It also wont end there in terms of invasiveness. Instead, they should focus on non-invasive mitigations such as: - Server-side anti-cheat. - Pay-once or subscription models to deter cheating. - Allow gaming coffee shops to authenticate themselves and give their customers privileged access to competitive worlds/instances. Because it’s much harder to cheat at these coffee shops already. - Shadow-ban repeat offenders or apply punishments without them realising that they’ve been detected. - Use bulk-banning to avoid giving cheaters a fast feedback loop which would otherwise make them understand what works and what doesn’t.
- buildartefact 4y agoEscape from Tarkov does all those things apart from coffee shops and shadow banning and still has a massive cheating problem.
- modshatereality 4y agoThey love their DRM. This won't stop programs running outside EA's view of "kernel space". Total waste of time, and opening a new side channel.
- mackatap 4y agoEpic games has kernel level anticheat for fortnite and you hardly ever run into a cheater, I honestly cannot recall running into a single one in the last 2 years. Compare that to warzone that is rampant with cheaters. Comes with trade offs, but it is effective. Cheating ruins competitive games.
- TylerH 4y agoI'd sooner have real IDs tied to internet personas than this shit
- taskforcegemini 4y agodon't encourage them
- rasz 4y agoWe need total DRM to sell you NFTs^^^uh, I mean player cards!
- peanut_worm 4y agoElden Ring has kernel-level anticheat and people STILL cheat
- db48x 4y agoNo thank you.
- pjmlp 4y agoThis is the kind of thing UWP sandbox, or killing kexts in macOS forbids, but hey lets enjoy the freedom of installing anything. They manage on mobile devices without kernel level anti-cheat systems.
- alex7734 4y agoYou have SafetyNet in Android which does the same thing, prevent device or app tampering.
- sascha_sl 4y agoBut that's built by the OS developers. I already trusted them. Now I need to trust Riot and EA and Blizzard and EAC to not fuck up basics of kernel module security.
- anvic 4y agoYou don't need that on mobile devices because Android and iOS already provide with attestation systems, which Windows lacks (by now)
- jbverschoor 4y agoSo run it in a VM and cheat from there?
- Szpadel 4y agofrom a long time already running in VM is automatically detected as cheating. a lot of people lost their accounts because of that (with permanent bans)
- lillecarl 4y agoCouldn't secureboot disable the kernel anticheat then? Microsoft has verified your kernel and drivers for you.
- mccorrinall 4y agoNo. A cheat developer could still just sign a driver like every other developer and load a hypervisor. Then hook everything you want and youre gucci. Another option: there are a lot of vulnerable drivers, such as intels LAN driver, or capcoms. Of course those are blacklisted and anti cheats usually don’t let you start the game when those are loaded, but you can use exploitable those to load your own driver, and then unload the vulnerable driver. Other things you can do: DMA stuff, uefi payloads and more. You will never be able to prevent cheating on user owned hardware which sits under their desk.
- google234123 4y agoExcept that all those things you listed are detectable or leave traces and can get you banned on most good anti cheats (EAC or the one that valorant uses)
- mccorrinall 4y agoNot true.
- donkarma 4y agoa properly implemented hypervisor cannot be detected outside of vague timing attacks which can be mitigated
- google234123 4y ago> a properly implemented hypervisor Very hard to do. There so many instructions that can be used to expose a HV. For VM hypervisors, MSRs aren't usually properly populated and all the junk that is exposed through WMI
- whatsthatabout 4y agoBad news for proton / the steamdeck I believe?
- goosedragons 4y agoDepends on whether EA cares enough about it. Epic did make EasyAntiCheat compatible with Proton so it's not un-doable. EA at least said it won't be every game either so hopefully if they didn't it won't be a huge problem either way.
- ElfinTrousers 4y agoIf anyone from EA is reading this, please consider this to be a formal invitation to kiss my skinny white ass.
- sascha_sl 4y agoGetting a machine dedicated to games where I don't do much else has been a decision that, although costly and annoying, keeps being correct.