6 ms·
Lets call them what they really are, rootkits.
by RobotToaster 2y ago
Lets call them what they really are, rootkits.
- jrepinc 2y agoThis, so much this. Also often spyware.
- schmidtleonard 2y agoFirst party malware.
- kulahan 2y agoCan't wait to find out what China hid in Riot's Vanguard rootkit for all their games. It's 100% a conspiracy theory, but nobody can convince me it's perfectly clean, or if it is, that there isn't an easy way to add some power to it quietly.
- jsheard 2y agoIf I wanted to deploy a trojan horse then the last place I would try to hide it is in an anti-cheat driver that will without any doubt be exhaustively analysed by people attempting to bypass it.
- throwaway48476 2y agoState sponsored actors only target a few people and they only send the backdoored version to their target list.
- thesuitonym 2y agoAh yes, that’s why stuxnet wasn’t a big deal
- throwaway48476 2y agoWhat do you mean? They burned several high value 0days on a high value target. Why wouldn't China burn a high value backdoor on a target they deem valuable enough.
- bravetraveler 2y agoGamers are great targets. They'll disable security for higher polling rates. Not discerning, gladly walk to the slaughterhouse.
- phito 2y agoThere's a ton of gamers that like to figure out how the game itself works. There's a ton of them trying to figure out how anti cheats work, sometimes to cheat, but more often because they're curious, resourceful teenagers taking it as a challenge.
- bravetraveler 2y agoOh, I know. That's how my career was started. I made invitational in CS: Source (CAL) and then sold cheats to pay for college. My first Real Job was through a teammate. Far more would have accepted a RAT and been deprived money than expressed genuine interest. Some did... not many. Most wanted the acclaim without the effort.
- Cthulhu_ 2y agoBut also there's parties there with a big interest in circumventing these securities, and have done so for decades. The new release of RDR for PC (shamefully asking $50 for a 14 year old game) was cracked within days, if not earlier, of its releae.
- vkou 2y agoAh, yes, for most of us, getting our computer pwned is just like being murdered.
- bravetraveler 2y agol o l Fine, they'll gladly eat shit
- vkou 2y agoHow much shit, and how does it compare to the risk profile of, say, not wearing a five points seat belt and motorcycling helmet while driving, or a bulletproof vest when going to school, or an N95 mask literally everywhere? Security theorists are always ready to tell us about the horrifying risks of installing kernel-level code from a vendor, but can they actually quantify the likelihood times damage those billions of installations have inflicted on Joe Random's life? And contrast them to other risks that we regularly take in the name of comfort and convenience?
- throwaway48476 2y agoChina's national security assistance law came up in the TikTok hearings. There's no reason to believe that the CCP doesn't have the legal authority to compel Riot to push an update with a backdoor to a few select high value targets.
- gorjusborg 2y agoCompanies rule the United States. Companies that do business in China are ruled by China. Therefore, the United States is ruled by China.
- vkou 2y agoThe same line of thinking leads me to conclude that the world is ruled by the United States. Can we stop with the nationalistic hyperbole already, and discuss acute issues, instead of vague fingerwaving at the foreign boogieman?
- gorjusborg 2y agoI wasn't being serious. Sorry to offend your motherland. You deserve all the social credit coming to you.
- deleted 2y ago[deleted]
- PaulHoule 2y agoIf it is written in C you can always introduce a buffer overflow or something similar by just adding a little bit of line noise here or there and nobody can prove it was deliberate.
- throwaway48476 2y agoIt's closed source and the assembly is obfuscated. You don't even need to bother with plausible debiability.
- Cthulhu_ 2y agoSurely the NSA has tools, people, resources etc to figure that out?
- throwaway48476 2y agoDedicated to reverse engineering every update to vanguard? Huge waste of effort. They would probably just steal the source code.
- Maken 2y agoThe NSA just needs a call to Riot headquarters to ensure their rootkit is also included.
- Levitating 2y agoThe vanguard drivers are signed by Microsoft, the procedure for which includes a safety audit by Microsoft. The driver is just what the developers say it is (as with all other anti-cheat). It provides an untempered interface for the userland anti-cheat to use to get info from the kernel. Because modern cheats tend to alter the output of kernel syscalls by running in the kernel themselves. I really don't see why anyone needs to think it's anything more than that. If Tencent needed to spy on you so badly there's no reason kernel anti-cheats need anything to do with it...
- cmxch 2y agoIt says something about Microsoft when they OK a known harmful bootkit that expects your computer to act like an XBox with a fancy keyboard (but not too fancy), requests invasive changes to UEFI that have broken systems, and have an overall opacity that rivals an Arthur C. Clarke Monolith.
- gruez 2y ago>The vanguard drivers are signed by Microsoft, the procedure for which includes a safety audit by Microsoft. Did the crowdstrike driver get the same audit?
- 15155 2y agoEAC and other kernel-level anticheat software will dynamically load and execute signed payloads at runtime. Does Vanguard do this? If so, does Microsoft check these payloads?
- Levitating 2y ago> EAC and other kernel-level anticheat software will dynamically load and execute signed payloads at runtime Are you sure about that?
- 15155 2y ago100%
- 2y ago
- tapoxi 2y agoI mean, they're not rootkits. Rootkits are either to gain root access (thus the name) or to hide something from a user. Anticheats don't do either of these. They expose a kernel API to allow games to verify the state of the system, and they're knowingly installed by the user.
- lomase 2y agoThe thing is the Kernel does not have that API. The real solution, and not the hack Riot uses, is for Kernel to provide an API for anticheats, like it does for everything useland.
- davrosthedalek 2y agoThat's not really possible as long as the kernel allows the loading of arbitrary user-provided modules. Because the cheater will certainly run the cheat that requires kernel mode. If it's run in kernel mode, the API call can be intercepted. How does the anticheat then work? Corewars. It's a cat and mouse game between the cheat provider and the game developer. One would need a secure base layer, where also the MS anti-cheat lives, and all drivers can only run in a layer between this base layer and userland. I think that's already done for most of the graphics stack. On the other hand, I am not convinced I want a system where I cannot load arbitrary kernel mode code if I choose to do so.
- Hikikomori 2y agoWindows only loads arbitrary modules if you enable some debug mode no? If not they need to be signed. But not a big hoop for cheat developers, they can get an EV cert to sign their own cheat kernel module or abuse a vulnerable kernel module.
- jolmg 2y ago> They expose a kernel API to allow games to verify the state of the system, and they're knowingly installed by the user. Can you give examples of games where you do that?
- OtomotO 2y agoThat's exactly what I tell my friends. I can't play certain games, because they don't run on Linux and even if they did, I am not gonna install a rootkit to run them.
- kibwen 2y agoGetting a Steam Deck has done wonders for my piece of mind. I don't need to worry if whatever games I'm installing are malicious, because the machine is airgapped from anything critical.
- Thaxll 2y agoAnd yet you install driver on Linux without knowing it, I mean Linux has 0 security for drivers.
- throwaway48476 2y agoWhen was the last time you had to install a Linux driver from out of tree?
- db48x 2y agoMost people do install Nvidia’s out‐of‐tree graphics driver. It is definitely a risk.
- cmxch 2y agoAnd in the case of Vanguard, a bootkit.