5 ms·

This article seems to be making all of the worst things about anti-cheat (kernel modules, mandatory Secure Boot/TPM, etc.) seem like good things. Why?

nekitamo 1y ago
The alternative is that the online games they're protecting become infested with cheaters, players depart, and the game closes down because it's no longer a viable business. It's not nice, I don't like running a kernel mode anti-cheat any more than you do, but I can see why it's necessary for preserving the competitive integrity of free-to-play shooter games like Valorant.
- imchillyb 1y ago
  If one must give up kernel level security of their system to an untrusted 3rd party, was it really free?
  - Hikikomori 1y ago
    Stuff you run as your user can already read all your files and memory of processes of that user so you're already very exposed.
- __alexs 1y ago
  They are already full of cheaters. DMA cards are undetectable even from kernel anti cheat.
  - doikor 1y ago
    The DMA card still needs to be installed, have drivers installed, firmware, etc. The anti cheat tests for that (the cheaters do mask the device spoofing the name/vendor/etc). Having to make new driver/firmware every time the anti cheat starts to detect it is way slower then just new software. Though at some point they will probably just automate it so that every customer gets their own driver and firmware matched with only their cheat software making this way harder but we are not there yet (and you would have to get all of these signed so following the cert chain should make it easier to find at least whos stolen cert they are using) Also the amount of people willing to buy another pc and DMA cards is way smaller making the chance of running into cheater in your match smaller.
    - az09mugen 1y ago
      That's a good idea indeed.
    - __alexs 1y ago
      Giving every customer their own firmware is already automated. Computer vision based cheats are also rapidly on the rise. You don't get wall hacks but you do top 1% reaction times and perfect tracking.
      - fc417fc802 1y ago
        Elephant in the room is that any behavior based solution that can reliably detect computer vision based cheating obviates the need for kernel level anti-cheat because it more or less solved the detection problem.
  - abigail95 1y ago
    are you writing your own firmware or hotwiring the bus? there are many methods to detect this.
doikor 1y ago
Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is very hard (or impossible) to detect it from user land outside of behavior (which mostly happens on the server side). Only thing I can think of is Microsoft locking down Windows so hard that nothing outside of code written (well signed) by Microsoft can run with kernel level privileges but I think that is an even worse option. If you don't like it you can always just go and play any of the titles without kernel level anti-cheat and get a cheater in ~1/5th of your games (my experience in counter strike).
- jjmarr 1y ago
  Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.
  - doikor 1y ago
    This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.
mvdtnz 1y ago
They're neither inherently good nor bad but unfortunately necessary.
johnnyanmac 1y ago
Insert the quote about freedom vs securities. This author (or his sponsors) clearly made their choice. Makes me glad I prefer mostly single player content and never tolerate this stuff on my PC. If I gotta be locked down I'll just pick up a console.
jokoon 1y ago
It can be seen as a Chinese backdoor on western computers. I am not expert, but I think it's not necessarily the case? Cheating is really a plague right now, and the only way to mitigate it is using kernel anti cheat.
- ronsor 1y ago
  And now AI can pretend to be input devices and need only video output. Kernel anti-cheat will be useless, and we'll be better off for it. If your solution is bad, it doesn't deserve to work. Find something else.
  - doikor 1y ago
    Though if the AI is only as good as a human can be it is not that desirable. If the cheat does "super human" stuff it can be detected from behavior on the server side though this is after the fact from processing some replay files and thus not that "great" for players as the cheater gets to ruin at least one game. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But it is something they acknowledge will be an issue at some point in the future. Personally I think for now AI is way too slow as all the computation needs to happen in a few milliseconds to really be effective. > Koskinas says he often worries about the use of AI for screen classification, to learn what human inputs look like, and how to reproduce them.
  - az09mugen 1y ago
    Since AI is everywhere you think it can be used to spot cheaters behaviours ?
    - ronsor 1y ago
      Yes, that's the real solution, not rootkits.
      - mschuster91 1y ago

nekitamo 1y ago

The alternative is that the online games they're protecting become infested with cheaters, players depart, and the game closes down because it's no longer a viable business. It's not nice, I don't like running a kernel mode anti-cheat any more than you do, but I can see why it's necessary for preserving the competitive integrity of free-to-play shooter games like Valorant.

imchillyb 1y ago
If one must give up kernel level security of their system to an untrusted 3rd party, was it really free?
- Hikikomori 1y ago
  Stuff you run as your user can already read all your files and memory of processes of that user so you're already very exposed.
__alexs 1y ago
They are already full of cheaters. DMA cards are undetectable even from kernel anti cheat.
- doikor 1y ago
  The DMA card still needs to be installed, have drivers installed, firmware, etc. The anti cheat tests for that (the cheaters do mask the device spoofing the name/vendor/etc). Having to make new driver/firmware every time the anti cheat starts to detect it is way slower then just new software. Though at some point they will probably just automate it so that every customer gets their own driver and firmware matched with only their cheat software making this way harder but we are not there yet (and you would have to get all of these signed so following the cert chain should make it easier to find at least whos stolen cert they are using) Also the amount of people willing to buy another pc and DMA cards is way smaller making the chance of running into cheater in your match smaller.
  - az09mugen 1y ago
    That's a good idea indeed.
  - __alexs 1y ago
    Giving every customer their own firmware is already automated. Computer vision based cheats are also rapidly on the rise. You don't get wall hacks but you do top 1% reaction times and perfect tracking.
    - fc417fc802 1y ago
      Elephant in the room is that any behavior based solution that can reliably detect computer vision based cheating obviates the need for kernel level anti-cheat because it more or less solved the detection problem.
- abigail95 1y ago
  are you writing your own firmware or hotwiring the bus? there are many methods to detect this.

doikor 1y ago

Realistically what is the alternative? That is pretty much the only way to ensure the cheats don't run at kernel level. If the cheat runs at kernel level it is very hard (or impossible) to detect it from user land outside of behavior (which mostly happens on the server side). Only thing I can think of is Microsoft locking down Windows so hard that nothing outside of code written (well signed) by Microsoft can run with kernel level privileges but I think that is an even worse option. If you don't like it you can always just go and play any of the titles without kernel level anti-cheat and get a cheater in ~1/5th of your games (my experience in counter strike).

jjmarr 1y ago
Chess essentially has ID verification at a high level because the best players can go to real-life tournaments and get titles for the prestige, which grants them free premium accounts on major platforms. It's easier to analyze the subset of top-tier players that aren't verified. I'd rather just give Riot Games my driver's licence than full access to my computer. They already know my name and where I live from metadata. There should be a KYC solution for gaming where a company like Epic, Riot, or Valve verifies your identity and developers can gate competitive video games behind that. If you cheat, you're out for 5-10 years (so dumb teenagers aren't locked out forever). The big issue imo isn't banning cheaters, it's preventing them from creating a new account and cheating again. Such a system would be free money & low maintenance for whatever company develops it first.
- doikor 1y ago
  This is actually how cheating is "solved" to some degree in South Korea. Basically you can't play without logging in with your government provided id. Though they do also use it for stuff like under 16 year olds not being able to play online games between midnight and 6am. edit: Some extra details about this from a few months ago https://x.com/deteccphilippe/status/1883945555102957617 https://x.com/deteccphilippe/status/1883945555102957617 > KR (Korea) requires national identity numbers for gaming, which opens up a convenient opportunity to ban cheaters at the “soul” level. It is remarkably effective at keeping them out of game for longer periods of time—cheaters have to buy whole new identities to keep playing, so the bans really stick.

mvdtnz 1y ago

They're neither inherently good nor bad but unfortunately necessary.

johnnyanmac 1y ago

Insert the quote about freedom vs securities. This author (or his sponsors) clearly made their choice. Makes me glad I prefer mostly single player content and never tolerate this stuff on my PC. If I gotta be locked down I'll just pick up a console.

jokoon 1y ago

It can be seen as a Chinese backdoor on western computers. I am not expert, but I think it's not necessarily the case? Cheating is really a plague right now, and the only way to mitigate it is using kernel anti cheat.

ronsor 1y ago
And now AI can pretend to be input devices and need only video output. Kernel anti-cheat will be useless, and we'll be better off for it. If your solution is bad, it doesn't deserve to work. Find something else.
- doikor 1y ago
  Though if the AI is only as good as a human can be it is not that desirable. If the cheat does "super human" stuff it can be detected from behavior on the server side though this is after the fact from processing some replay files and thus not that "great" for players as the cheater gets to ruin at least one game. > “You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” said Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.” But it is something they acknowledge will be an issue at some point in the future. Personally I think for now AI is way too slow as all the computation needs to happen in a few milliseconds to really be effective. > Koskinas says he often worries about the use of AI for screen classification, to learn what human inputs look like, and how to reproduce them.
- az09mugen 1y ago
  Since AI is everywhere you think it can be used to spot cheaters behaviours ?
  - ronsor 1y ago
    Yes, that's the real solution, not rootkits.
    - mschuster91 1y ago