7 ms·

After the crowdstrike disaster 3rd party kernel drivers need to be shunned for non critical applications. Games publishers have been bad actors in this space f

After the crowdstrike disaster 3rd party kernel drivers need to be shunned for non critical applications. Games publishers have been bad actors in this space for a long time now. The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault.

doublerabbit 2y ago
What decides critical or non-critical. One could argue that a game isn't critical but one could say it's critical to stop hackers. If you were to take the stance that gaming isn't critical than with that logic you're then claiming multiplayer hacking is a feature of the game. Doesn't do well for the community or the company. But nor do the rootkits do good for the consumer.
- throwaway48476 2y ago
  Critical as in "my gpu is a paperweight without a driver".
  - sgjohnson 2y ago
    GPU driver can technically be userland too. Look at what Apple has done in recent years. kexts (kernel-level drivers) are basically all but unsupported today, and both DriverKit and IOKit are fully userland.
    - throwaway48476 2y ago
      Performance critical drivers are always going to be kernel mode.
- avery17 2y ago
  It hasn't stopped hackers though.
  - caiomassan 2y ago
    at least they need to search more than the first cheat option on google.
  - lomase 2y ago
    To be fair it stopped hackers for a while. Many people said Valorant did not have cheaters. But nowdays the Valorant community complains about hackers almost as the CS community.
    - orwin 2y ago
      It's because nowadays cheats run on a secondary machine, often a Pi,so rootkits have less impacts.
- Nadya 2y ago
  If they worked to any acceptable level of efficacy then they could be tolerated. They're only tolerated by people who think they work as well as they claim to work (security theater) but anyone who knows about the performance impacts and/or are tech-savvy enough to understand it is a rootkit and potential exploit (that would fully pwn your device) hates them. Some cheats are getting rather sophisticated now. There's an ever-increasing number of Pi-devices where the cheating is done externally. https://www.youtube.com/watch?v=QpvwjC1_Luo https://www.youtube.com/watch?v=QpvwjC1_Luo https://www.youtube.com/watch?v=revk5r5vqxA https://www.youtube.com/watch?v=revk5r5vqxA
  - ThatPlayer 2y ago
    They're also chosen by users when the game is filled with cheater. Counterstrike 2 is an example of this with players moving to FaceIT and ESEA (with kernel anti cheat) as the higher ranks of official competitive matchmaking are filled with cheaters.
    - lomase 2y ago
      FaceIT works better than normal matchaking, but I am not sure is because is a Kernel level anticheat. FaceIT only sells one thing, matchmaking, so they have people manually reviewing games. A thing that Valve will never do.
  - tadfisher 2y ago
    That's child's play. The vogue is PCIe devices that sniff draw calls, memory transfers and network activity on the bus.
  - Thaxll 2y ago
    Performance impact is overblown, it was proven that the lost of perf is marginal when implemented properly.
    - Nadya 2y ago
      Proven by who and what proof? Because Denuvo is the only one outspoken about how it doesn't impact performance despite all evidence to the contrary and they provide no evidence of their own beyond claiming it doesnt. Then saying they'll prove it doesn't and then backing out of proving it. https://www.resetera.com/threads/irdeto-backtracks-on-plans-to-prove-denuvo-drm-doesnt-hurt-performance.1017801/ https://www.resetera.com/threads/irdeto-backtracks-on-plans-...
- 2OEH8eoCRo0 2y ago
  > one could say it's critical to stop hackers. It's never critical to stop hackers in a videogame IMO. We need to stop being so damn serious about gaming.
  - codebje 2y ago
    Rampant cheating will wreck competitive multiplayer games fast, so there are perspectives from which this critical. (I’d still lean towards expecting game houses to find another way, kernel drivers are still client side trust mechanisms).
    - heromal 2y ago
      I think the point is that competitive multiplayer games are not critical. Scripting in e.g. league of legends probably doesn't register on 99% of humanities "top 100 most critical things in my life" radar.
      - 2OEH8eoCRo0 2y ago
        That was my point. We forgot we were gaming, probably due to all the money being thrown around.
        codebje 2y ago
        No-one likes playing with a cheat in Uno, either, and the table stakes for Uno are pretty low.
      - prerok 2y ago
        For some people it's no. 1 priority in life. What's your point?
      - codebje 2y ago
        The LoL game development studio probably rates their game being a commercial success as a significantly critical thing.
    - 2y ago
RobotToaster 2y ago
Lets call them what they really are, rootkits.
- jrepinc 2y ago
  This, so much this. Also often spyware.
- schmidtleonard 2y ago
  First party malware.
- kulahan 2y ago
  Can't wait to find out what China hid in Riot's Vanguard rootkit for all their games. It's 100% a conspiracy theory, but nobody can convince me it's perfectly clean, or if it is, that there isn't an easy way to add some power to it quietly.
  - jsheard 2y ago
    If I wanted to deploy a trojan horse then the last place I would try to hide it is in an anti-cheat driver that will without any doubt be exhaustively analysed by people attempting to bypass it.
    - throwaway48476 2y ago
      State sponsored actors only target a few people and they only send the backdoored version to their target list.
      - thesuitonym 2y ago
        Ah yes, that’s why stuxnet wasn’t a big deal
        throwaway48476 2y ago
        What do you mean? They burned several high value 0days on a high value target. Why wouldn't China burn a high value backdoor on a target they deem valuable enough.
Thaxll 2y ago
Cheats and bots are ruining online games though.
- umvi 2y ago
  Yeah life sucks when everything and everyone has to be untrusted (applies not just video games). The solution is to build trusted spaces again IMO. For video games assume that each user is trusted by default. As soon as they violate that trust by cheating, they are banned permanently for that copy of the game. If they want to be trusted again they have to buy another copy of the game to get another license. Make it hard to become a member of a trusted community and easy to be kicked out of a trusted community for violating trust. This would eliminate the vast majority of cheating and bots because most gamers are kids and having to buy a fresh copy will hit hard. If they abuse it enough, make them jump through more hoops like ip bans and computer fingerprint bans.
  - codebje 2y ago
    False positives would very much hurt in that model. But returning to a small multiplayer experience with chosen friends would work: the in/out decision is local and personal. It’s only a problem when you game with strangers.
  - billyoyo 2y ago
    This is a naive take. Of course these developers already permaban cheaters. Firstly many of these games are free to play so "getting another license" is a non issue. They're doing hardware bans nowadays which are harder to avoid but not impossible. Half the battle is detection though. If you don't detect cheaters quick enough they ruin enough games that genuine players start getting frustrated and leave. Anti cheats help with this detection. Probably every anti cheat idea you can think of, in terms of detection, prevention and punishment, has probably already been tried by a large online multiplayer game. It is an extremely difficult problem to solve, a constant arms race.
    - keyringlight 2y ago
      It's going on a tangent, but one naive take which continues to amuse me when it comes up is community/third party servers and policing of cheating. As though delegating that responsibility is the goal or that it would scale to handle the size of modern playerbases including the ratio of admins to players to be able to monitor and respond to (alleged) cheaters
orbital-decay 2y ago
> The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault. I mean, nothing of this is new. ESEA, one of the most influential esports leagues, was caught using its anticheat to mine Bitcoin in 2013. [1] This is long out of control, probably since the days BattlEye switched to ring0 in 2012 due to chronic cheating in the DayZ mod, or maybe earlier. Modern anticheats are full-fledged rootkits with extremely complex and targeted payloads siphoning customer data and hijacking all sorts of stuff, and that's not a theory, they actively abuse players' trust and indifference. If you care about your data and the control of your devices, you should probably avoid them entirely, or at least use them on dedicated gaming PCs on a clean identity, and keep them separate from your LAN and your non-gaming digital life. [1] https://play.esea.net/forums/492102 https://play.esea.net/forums/492102
- wilsonnb3 2y ago
  People really need to find a better word than 'rootkit' to describe software that users willingly and intentionally give root access.
  - drilbo 2y ago
    I think it's fair to say that a lot of users have no idea they're doing so, hence why changes like the one in TFA are necessary to encourage transparency around these practices
    - chainingsolid 2y ago
      I've ran the installer for Vallorent. I don't remember it telling me it was going to go run code in ring 0. And I would likely have ended the install there if they listed any of the downsides. For most gamers you'd have to invoke Cloud Strike, to explain whats happening. They play games not study CS.
  - Nathanba 2y ago
    I agree, we need something that emphasizes that it executes undesired functions. "Trojan horse" would fit better but it's associated with computer virii now. I think I would call it something like "Traitor software".. it generally does the functions you installed it for and pretends to be normal software but then when you aren't looking it betrays you later.
hayst4ck 2y ago
Crowdstrike isn't even the worst case. The SolarWinds disaster is the worst case scenario. You have a closed source rootkit designed for finding data in raw memory (like passwords from an unlocked password manager), loaded into many gamer's machines, which many software engineers are. Some anti cheat explicitly support's arbitrary remote code execution by design. Many people mix their personal password vaults with their company's, which means that if you successfully hack an anticheat company and you can read the raw memory of an opened password manager with a program that is already designed to scan all processes memory, you now potentially have extremely valuable credentials. A small portion will even do things like add their 2fac keys into their vaults. Here is Gabe Newell's thoughts on AntiCheat that are very relevant to this thread: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an... Of course the other problem is the 23andMe problem and enshitification. Even if the data uploaded by anti-cheat isn't used right now, the storage of data alone creates incentive for abuse.
- Gigachad 2y ago
  Something slightly related happened recently. A bit of malware that was distributed as a mod for BeamNG was installed by a high up Disney employee, who was also logged in to some internal work stuff. The hackers were able to leak huge amounts of company data.
gauge_field 2y ago
I just want to spam skill shot with ranged-heros on Aram 1-2 times a week. No way I am running vanguard for that!!!!
deleted 2y ago
[deleted]

doublerabbit 2y ago

What decides critical or non-critical. One could argue that a game isn't critical but one could say it's critical to stop hackers. If you were to take the stance that gaming isn't critical than with that logic you're then claiming multiplayer hacking is a feature of the game. Doesn't do well for the community or the company. But nor do the rootkits do good for the consumer.

throwaway48476 2y ago
Critical as in "my gpu is a paperweight without a driver".
- sgjohnson 2y ago
  GPU driver can technically be userland too. Look at what Apple has done in recent years. kexts (kernel-level drivers) are basically all but unsupported today, and both DriverKit and IOKit are fully userland.
  - throwaway48476 2y ago
    Performance critical drivers are always going to be kernel mode.
avery17 2y ago
It hasn't stopped hackers though.
- caiomassan 2y ago
  at least they need to search more than the first cheat option on google.
- lomase 2y ago
  To be fair it stopped hackers for a while. Many people said Valorant did not have cheaters. But nowdays the Valorant community complains about hackers almost as the CS community.
  - orwin 2y ago
    It's because nowadays cheats run on a secondary machine, often a Pi,so rootkits have less impacts.
Nadya 2y ago
If they worked to any acceptable level of efficacy then they could be tolerated. They're only tolerated by people who think they work as well as they claim to work (security theater) but anyone who knows about the performance impacts and/or are tech-savvy enough to understand it is a rootkit and potential exploit (that would fully pwn your device) hates them. Some cheats are getting rather sophisticated now. There's an ever-increasing number of Pi-devices where the cheating is done externally. https://www.youtube.com/watch?v=QpvwjC1_Luo https://www.youtube.com/watch?v=QpvwjC1_Luo https://www.youtube.com/watch?v=revk5r5vqxA https://www.youtube.com/watch?v=revk5r5vqxA
- ThatPlayer 2y ago
  They're also chosen by users when the game is filled with cheater. Counterstrike 2 is an example of this with players moving to FaceIT and ESEA (with kernel anti cheat) as the higher ranks of official competitive matchmaking are filled with cheaters.
  - lomase 2y ago
    FaceIT works better than normal matchaking, but I am not sure is because is a Kernel level anticheat. FaceIT only sells one thing, matchmaking, so they have people manually reviewing games. A thing that Valve will never do.
- tadfisher 2y ago
  That's child's play. The vogue is PCIe devices that sniff draw calls, memory transfers and network activity on the bus.
- Thaxll 2y ago
  Performance impact is overblown, it was proven that the lost of perf is marginal when implemented properly.
  - Nadya 2y ago
    Proven by who and what proof? Because Denuvo is the only one outspoken about how it doesn't impact performance despite all evidence to the contrary and they provide no evidence of their own beyond claiming it doesnt. Then saying they'll prove it doesn't and then backing out of proving it. https://www.resetera.com/threads/irdeto-backtracks-on-plans-to-prove-denuvo-drm-doesnt-hurt-performance.1017801/ https://www.resetera.com/threads/irdeto-backtracks-on-plans-...
2OEH8eoCRo0 2y ago
> one could say it's critical to stop hackers. It's never critical to stop hackers in a videogame IMO. We need to stop being so damn serious about gaming.
- codebje 2y ago
  Rampant cheating will wreck competitive multiplayer games fast, so there are perspectives from which this critical. (I’d still lean towards expecting game houses to find another way, kernel drivers are still client side trust mechanisms).
  - heromal 2y ago
    I think the point is that competitive multiplayer games are not critical. Scripting in e.g. league of legends probably doesn't register on 99% of humanities "top 100 most critical things in my life" radar.
    - 2OEH8eoCRo0 2y ago
      That was my point. We forgot we were gaming, probably due to all the money being thrown around.
      - codebje 2y ago
        No-one likes playing with a cheat in Uno, either, and the table stakes for Uno are pretty low.
    - prerok 2y ago
      For some people it's no. 1 priority in life. What's your point?
    - codebje 2y ago
      The LoL game development studio probably rates their game being a commercial success as a significantly critical thing.
  - 2y ago

RobotToaster 2y ago

Lets call them what they really are, rootkits.

jrepinc 2y ago
This, so much this. Also often spyware.
schmidtleonard 2y ago
First party malware.
kulahan 2y ago
Can't wait to find out what China hid in Riot's Vanguard rootkit for all their games. It's 100% a conspiracy theory, but nobody can convince me it's perfectly clean, or if it is, that there isn't an easy way to add some power to it quietly.
- jsheard 2y ago
  If I wanted to deploy a trojan horse then the last place I would try to hide it is in an anti-cheat driver that will without any doubt be exhaustively analysed by people attempting to bypass it.
  - throwaway48476 2y ago
    State sponsored actors only target a few people and they only send the backdoored version to their target list.
    - thesuitonym 2y ago
      Ah yes, that’s why stuxnet wasn’t a big deal
      - throwaway48476 2y ago
        What do you mean? They burned several high value 0days on a high value target. Why wouldn't China burn a high value backdoor on a target they deem valuable enough.

Thaxll 2y ago

Cheats and bots are ruining online games though.

umvi 2y ago
Yeah life sucks when everything and everyone has to be untrusted (applies not just video games). The solution is to build trusted spaces again IMO. For video games assume that each user is trusted by default. As soon as they violate that trust by cheating, they are banned permanently for that copy of the game. If they want to be trusted again they have to buy another copy of the game to get another license. Make it hard to become a member of a trusted community and easy to be kicked out of a trusted community for violating trust. This would eliminate the vast majority of cheating and bots because most gamers are kids and having to buy a fresh copy will hit hard. If they abuse it enough, make them jump through more hoops like ip bans and computer fingerprint bans.
- codebje 2y ago
  False positives would very much hurt in that model. But returning to a small multiplayer experience with chosen friends would work: the in/out decision is local and personal. It’s only a problem when you game with strangers.
- billyoyo 2y ago
  This is a naive take. Of course these developers already permaban cheaters. Firstly many of these games are free to play so "getting another license" is a non issue. They're doing hardware bans nowadays which are harder to avoid but not impossible. Half the battle is detection though. If you don't detect cheaters quick enough they ruin enough games that genuine players start getting frustrated and leave. Anti cheats help with this detection. Probably every anti cheat idea you can think of, in terms of detection, prevention and punishment, has probably already been tried by a large online multiplayer game. It is an extremely difficult problem to solve, a constant arms race.
  - keyringlight 2y ago
    It's going on a tangent, but one naive take which continues to amuse me when it comes up is community/third party servers and policing of cheating. As though delegating that responsibility is the goal or that it would scale to handle the size of modern playerbases including the ratio of admins to players to be able to monitor and respond to (alleged) cheaters

orbital-decay 2y ago

> The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault. I mean, nothing of this is new. ESEA, one of the most influential esports leagues, was caught using its anticheat to mine Bitcoin in 2013. [1] This is long out of control, probably since the days BattlEye switched to ring0 in 2012 due to chronic cheating in the DayZ mod, or maybe earlier. Modern anticheats are full-fledged rootkits with extremely complex and targeted payloads siphoning customer data and hijacking all sorts of stuff, and that's not a theory, they actively abuse players' trust and indifference. If you care about your data and the control of your devices, you should probably avoid them entirely, or at least use them on dedicated gaming PCs on a clean identity, and keep them separate from your LAN and your non-gaming digital life. [1] https://play.esea.net/forums/492102 https://play.esea.net/forums/492102

wilsonnb3 2y ago
People really need to find a better word than 'rootkit' to describe software that users willingly and intentionally give root access.
- drilbo 2y ago
  I think it's fair to say that a lot of users have no idea they're doing so, hence why changes like the one in TFA are necessary to encourage transparency around these practices
  - chainingsolid 2y ago
    I've ran the installer for Vallorent. I don't remember it telling me it was going to go run code in ring 0. And I would likely have ended the install there if they listed any of the downsides. For most gamers you'd have to invoke Cloud Strike, to explain whats happening. They play games not study CS.
- Nathanba 2y ago
  I agree, we need something that emphasizes that it executes undesired functions. "Trojan horse" would fit better but it's associated with computer virii now. I think I would call it something like "Traitor software".. it generally does the functions you installed it for and pretends to be normal software but then when you aren't looking it betrays you later.

hayst4ck 2y ago

Crowdstrike isn't even the worst case. The SolarWinds disaster is the worst case scenario. You have a closed source rootkit designed for finding data in raw memory (like passwords from an unlocked password manager), loaded into many gamer's machines, which many software engineers are. Some anti cheat explicitly support's arbitrary remote code execution by design. Many people mix their personal password vaults with their company's, which means that if you successfully hack an anticheat company and you can read the raw memory of an opened password manager with a program that is already designed to scan all processes memory, you now potentially have extremely valuable credentials. A small portion will even do things like add their 2fac keys into their vaults. Here is Gabe Newell's thoughts on AntiCheat that are very relevant to this thread: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/ https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an... Of course the other problem is the 23andMe problem and enshitification. Even if the data uploaded by anti-cheat isn't used right now, the storage of data alone creates incentive for abuse.

Gigachad 2y ago
Something slightly related happened recently. A bit of malware that was distributed as a mod for BeamNG was installed by a high up Disney employee, who was also logged in to some internal work stuff. The hackers were able to leak huge amounts of company data.

gauge_field 2y ago

I just want to spam skill shot with ranged-heros on Aram 1-2 times a week. No way I am running vanguard for that!!!!

deleted 2y ago

[deleted]