7 ms·
> The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the st
by orbital-decay 2y ago
> The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault.
I mean, nothing of this is new. ESEA, one of the most influential esports leagues, was caught using its anticheat to mine Bitcoin in 2013. [1] This is long out of control, probably since the days BattlEye switched to ring0 in 2012 due to chronic cheating in the DayZ mod, or maybe earlier. Modern anticheats are full-fledged rootkits with extremely complex and targeted payloads siphoning customer data and hijacking all sorts of stuff, and that's not a theory, they actively abuse players' trust and indifference.
If you care about your data and the control of your devices, you should probably avoid them entirely, or at least use them on dedicated gaming PCs on a clean identity, and keep them separate from your LAN and your non-gaming digital life.
[1] https://play.esea.net/forums/492102 https://play.esea.net/forums/492102
- wilsonnb3 2y agoPeople really need to find a better word than 'rootkit' to describe software that users willingly and intentionally give root access.
- drilbo 2y agoI think it's fair to say that a lot of users have no idea they're doing so, hence why changes like the one in TFA are necessary to encourage transparency around these practices
- chainingsolid 2y agoI've ran the installer for Vallorent. I don't remember it telling me it was going to go run code in ring 0. And I would likely have ended the install there if they listed any of the downsides. For most gamers you'd have to invoke Cloud Strike, to explain whats happening. They play games not study CS.
- Nathanba 2y agoI agree, we need something that emphasizes that it executes undesired functions. "Trojan horse" would fit better but it's associated with computer virii now. I think I would call it something like "Traitor software".. it generally does the functions you installed it for and pretends to be normal software but then when you aren't looking it betrays you later.
- froggit 2y agoIt's quite literally kit running as root...
- davrosthedalek 2y agoIt's quite literally not. Root is technically a user with extra rights (including modifying the kernel, but there is still an API the root user has to go through). This is running as part of the kernel. It's not running in userland "as root". A rootkit is something that gives other users the power of root.
- bigstrat2003 2y agoThat's taking it too far. By that logic, rootkits can't exist for Windows because the super user is called "Administrator", not "root".